Adding Web Layer for mattermost as security

As we no, there is no web server as such in mattemost server, it installs as a single compiled binary file and entire mattermost server is accessible through RESTful web service API.

I have installed app and db on same server. We are exposing it to internet and now security team has raised concerns.

If mattermost or any application which is hosted on same server without any extra layer (in my case its only app and db) it will be an risk to all other server which is on same vlan. Security team says it will be better if we can add web layer which will give some security to the application.

So If i configure NGNIX will it be my webserver or just an proxy server?

Thanks in advance Cipher