is it possible to seperate the osquery TLS server and web application? meaning if I were to host this fleet on public facing, can I only expose the osquery TLS server, but not the web application?

This capability is not built into Fleet, but you can do so with an LB that only exposes some of the routes to the public.

awesome thanks!