I'm looking into deploying my own prisma server, but would like to be able to use prisma cloud with it. I will have set a management secret that I can use with prisma cloud, but I don't understand what I need to do to make the management API accessibl by prisma cloud, but protected the database from public access? If I expose port 4466 to the public, then anybody could read my data?

You need set the managementApiSecret and then need to provide the secret to Prisma cloud. Without the secret no one can access the data, and you can generate a authorization token to query the DB using playground by using

prisma token

command.