PXE is automagic being basically kind of hacky extension to DHCP stuff.

If PXE is enabled the machine will automatically find it via a DHCP relay on the network.

the boot image supplying server being in the same intranet as the rest of the other servers … Since the first mode is probably too unsafe, that leaves us with the second mode.

Why do you think that’s unsafe?