The options you note:
- (1) Oracle HTTP Server with MOD_PLSQL
- (2) Oracle APEX Listener
- (3) Embedded PL/SQL Gateway
For each option, pro/con:
(1) Original solution. Full flexibility of an http server with rewrite rules, access rules, etc. However, loading additional modules for mixed application server use can be painful because of the custom Apache build. Also, licensing additional products from Oracle can be pricy.
(2) Latest solution. Most flexible, it can be used in any j2ee container (Tomcat, Glassfish, Weblogic, old OC4J, etc), but should be combined with a true http server with access rules, etc for security (Tomcat is typically combined with HTTPD for this purpose). This does have the problem in that currently this must be deployed for each connection configuration, while (1) is deployed for the whole server with the single configuration.
(3) This is typically not recommended for external deployment in any case. Included is the issue with direct access to the database server from external clients. This can be helped with HTTPD as a proxy server (like Tomcat above).
In existing installs, where you already have mod_plsql applications in place, put the APEX dad along side those and you should be set using solution (1). For new installs, I would go with (2). (3) is a viable option for initial setup and testing, but should be replaced prior to production deployment.