Incase even if you have open ports I dont see it as a cause of concern.It will be,if there are services or daemons[as they are more commonly called under GNU/Linux] running on that port/s.
Like for example you have port 80 open inbound[remember I'm talking about inbound here & not outbound which you normally use when you fire up your favourite browser],there would be no alarm bells ringing apart from now passe port scans by script kiddies.
But there would be huge concerns if you had a service like Apache or any other web server software running there listening for connections.This implies that there is a service to be exploited.
The author never asked which is the "best" & IMHO "best" is subjective to one's needs & requirements.
Please refrain from posting un-necessarily.