To me, I use GUI to check if asterisk is running and to create user over the web. Dial plan and other functions are done via APL.
But GUI gives me an idea when I am far away from home where I can't use SSH.
I used to run my Asterisk either via APL or GUI. Your suggested way of running it via a mixed mode seems more efficient and effective when we need to administer our server.
There are several more options we discussed in the afternoon.
1. use web for central administration. I use SSL-VPN if possible. Now my router allows me to do so.
2. disable remote access via SSH and FTP to the IP0x box. It is dangerous. Also change the default root password to some other you like
3. GUI for asterisk is only for status review and very simple function. We have to find out the right combination. Perhaps disable administrative rights from internet connection unless you can do so in 4 below
4. you may need to limit the IP allowed to connect but only apply to fixed IP.