Your security concern level depends on whether this is intranet or Internet facing (though 'safer in intranet' may be misleading depending on your firewall and overall net security).
Having the apache user have write access to the files is bad for security. If the server is rooted, then they can change content. Of course, you allowing file uploads with no vetting is a much bigger security issue - no apache hole needed. You're better off with upload to some directory out of webserver, wait to vet, move to webserver area.
If files are owned by root, then only the root user can modify them. That means all processes changing them need to be root, which is a security concern. Are you willing to give root/sudo to all web content authors? I'd recommend against this.
If possible, apache and its logs should be on a separate volume, at least off of /bin/ and /var. Overgrown logfiles or huge uploaded files can cause Denial Of Service for your OS - Linux systems act weird with 100% full /var partitions.
If you're going full LAMP with users, then you have to worry about the coding skills of your users. Make PHP secure as possible (sigh, why isn't there a better language, PHP really is horrible, but there's nothing remotely as good as it for quick content). Compile only DB access that uses parameterized queries (eliminates almost all sql injection attacks). Design your schema and authorizations in MySQL so you isolate all the users.
