The answer is XPUB. That way the only thing you store on your server is the minimal information to allow your code to create new addresses.
In case you get hacked, you would at most lose the list of addresses of that XPUB - never the funds.
You can use this code as starting point or as tools to generate lists of addresses from your XPUB:
https://github.com/dan-da/hd-wallet-derivehttps://github.com/dan-da/hd-wallet-addrsThen you only need to monitor transactions to those addresses which is pretty simple if you use an API (you don't even need to run any software on your server).
If you really want to also have control on the validation of funds, you'll need a Full Bitcoin Node.