Who can call a public function?

Thank you @Kush_Patel, yes, that answers my question.

Now if we are at it I want to ask a question to your comment:

The System setting also bypasses data access permissions which is likely not what you want.

As I understand it, if I don’t use System permissions it means that I have to grant the end-users access to the collections (via the data access permissions).
Now I am developing a sort of an “admin” protal, where I just want the users to be able to fetch specific reports, I don’t like the idea of letting the users read access to the collections, that’s why I want no one to have access to the data aside for the backend functions.
Does it make sense to do what I do or is there another more secure way to acheive this?