I think there are a couple of things you should check out first which will serve you as an introduction.
What you have in /var/www/html is what is called a "Directory" for a Virtual Host in Apache.
What does this mean? It means this directory has been created and defined by default for you. It also means you can create a directory anywhere in your filesystem and assign it as the directory for this Virtual Host.
Where does this Virtual Host definition live? In LAMP, you have this called Virtual Hosts. This means you can host many websites and resources in your same server/machine. These virtual hosts are usually defined under /etc/apache2/sites-available/
If you check that folder you'll find this file: 000-default.conf
There's where /var/www/html is defined. You are actually free to modify this, and place it, let's say somewhere beneath your /home/{user} directory.
I recommend you as a next step for your introduction to LAMP (in Linux) to take a look at Virtual Hosts. How to create them, and how to make them work.
You will find some Apache commands like a2ensite a2dissite to make the new virtual host sites available or disable them and many other interesting things in the way.
Security Issues:
About your security concerns if you want to be sure no-one has access to your /var/www/html you should have an active firewall. The firewall would block any non-requested communication to port 80, which is the port wide open for /var/www/html
You should notice that the Virtual Host defined by default has the widest possible access. It's defined like this <VirtualHost *:80>
. This definition makes anyone guesssing your IP in your LAN to have access to see your /var/www/html. That's actually the purpose of a server, to serve things to the outside world. So that's basically ok.
But if you want to protect that, you have to either created a new VirtualHost, aka a named Virtual host, and probably use a Firewall to protect your ports (port 80, and whatever other port you wanna use)