Why not both? it makes more sense to only use the lightning network itself with onion messages without using the node clearnet ip & port. in the case of "direct" connection - isn't limit incoming clearnet node traffic only from the wiregaurd tunnel a better practice? 

 *limiting