Yes, you need to secure the traffic.
"if you need Docker to be reachable through the network in a safe
manner, you can enable TLS by specifying the tlsverify flag and
pointing Docker’s tlscacert flag to a trusted CA certificate. In the
daemon mode, it only allows connections from clients authenticated by
a certificate ...
Yes, It's enough, but you can harden it using XPACK, Xpack is available now in free version of ELK.
Please check the reference regarding XPACK: https://www.elastic.co/guide/en/elasticsearch/reference/current/setup-xpack.html
You can run elasticsearch in local network only, If you want to access it later outside your network you can use NGINX Reverse Proxy