This is from memory ....
There was a physical directory called moodledata on the web server so config.php pointed to that.
Inside moodledata ... sessions, cache, localcache, mdeploy, temp ... anything that required fast access by the web server were true directories.
filedir and trashdir were symlinks that pointed to mount points on the web server that pointed to NFS mounts ... which could be located in places like /mnt/data/filedir and /mnt/data/trashdir
I had a heck of time convincing the network/server Gods to allow local backups of the code directory and a DB dump remain on the web server ... in places like /home/backup/
Reason for them ... in case site restore was needed ... faster access to that which was more than likely needed to do a site restore.
Web servers had public IP addresses in them but only port 80 opened both ways.
To ssh into server, VPN to the DB box was required, then one could ssh from inside out to the web server. While in their VPN, was restricted by their filter ... which meant I need to get ducks in a row etc. maybe even store some stuff on my laptop to be able to 'get the job done'.
Ran Tuner on Web server and on DB server. One would need to tweak mysql according to how the Tuner on the Web server saw things.
As far as Moodle code ... installed via git ... maintained via git - as long as I had access to it. Recently, however, the server person internal decided to upgrade to 3.0.1 when he read about PHP7 (despite that being pretty much Beta) and when he did, didn't continue to use git ... an action think he will regret taking (at least the git part). Good to see someone internal taking ownership. As far as 'loosing a client' ... heck, I've been involved in education all my life where one is supposed to work themselves out of a job - independence.
Best way? Well, like I said ... they had requirements ... non-negotiable.
Anyone taking this same approach, be prepared to tinker and *document* very accurately for the next person who comes along. And to expect filedir/trashdir to be slower than if on web server. Can't get blood out of a turnip!
That help?
'spirit of sharing', Ken