100% private. That is the point of the VPN.

If you use public you don't need the VPN. You'll also have to forward 4 ports (137-139 and 445) per PC and life starts getting difficult.

That Private IP and Public IP setting has different wording on the 2820 series, on there it is Route or NAT.
Personally I think Route (Private IP) is the more reliable one to use, as long as the traffic is properly encrypted there's not any risk in my opinion.