I'm looking a way for secure setup of web site that accepts bitcoin payments. Ideally I'd like to create wallet off-site and be able to deploy bitcoin core online with public key only that I believe should be enough to generate new addresses and watch for incoming payments
can I run bitcoin core with public key only
That would be a watch-only wallet - usually achieved by importing an externally derived address.
deploy bitcoin core online with public key only that I believe should be enough to generate new addresses
In principle you can derive addresses from a public key but, as far as I know, Bitcoin core doesn't provide any way to import a public key and derive addresses from it. But I haven't tried.
- How to import an extended public key into bitcoin core 0.16
You could always generate addresses from a public key externally and then use the Bitcoin core API to import those addresses. There are many Bitcoin libraries for popular programming languages.