Maybe it is still a fair question for machines that should only be reachable by other machines you fully own (like database servers and so on)? Just thinking out loud.
Hetzner VPS instances don't need to have public IP addresses.
>Assign Primary IPs to your server to establish a connection to the internet. Or create a private-network-only cloud server by not adding any Primary IPs at all. You can change the selected network option at any time.