CentOS or Debian. Go for a minimal install of either, then add only what you need (beware, minimal installs are very minimal; they actually don't even have vim by default, only a cut down vi). That said, if you forward the SSH port from the internet, use public key only for authentication (and if you forward ports for other things such as a webserver, keep it up to date) and you're fine.

Avoid consumer-focused distros like Ubuntu or Fedora; you'll also learn more by avoiding them as they tend to hand-hold the user and hide functionality and configuration from them.