I would suggest WPA2 only, and disabling both WPS, and UPNP, and disabling remote management as well, and if possible, change the HTTP port to access your router from port 80 to a not well known port so not somewhere between port 1 - 1024, and set your firewall to not respond to WAN ping. You will be quite safe then.

I supposed u mean this. In TR-069 under Management & Diagnosis tab.

Yes, should be but don't know any impact by turning off TR-069.

No impact at all. TR-069 is used by TM to remotely configure your BTU & router. Turning it off on the router means they can no longer do that but it doesn’t matter on the router side.

It's here. Change Mode to Discard.

TR-069 is remote management for TM's use only. It runs on a different VLAN so it's not publicly accessible from the internet. With this, TM can configure your router if the need arises. They also use this to control or configure the BTU. This only works with stock TM routers. You can leave this on, it should be safe.

The other remote management that we talk about is the router's web configuration page. The same one that you're accessing from your LAN. If you don't need to access your router's config remotely then you should turn this off for remote access.

If you look closely at the screenshot, the one to set to "Discard" is under WanControl. That's the one for remote access. You disable this one, you can still access via LAN. Don't kacau the LanControl one or else you won't be able to access it at all.