In a Windows environment where security is more important than flexibility, is Windows 2008 R2 Core Server installation the best option? How much more difficult is it to setup an environment with Server Core?
Server core isn't really (fundamentally) about security, it is more about trying to use Windows with the lowest footprint/bare essentials.
Based on the fact it has hardly anything running by default, out of the box, it probably is more secure - but - any software you install on top of it will not magically become secure because it is installed on Server Core.
For example, if you were to have a dynamic website with a SQL injection bug, it can be exploited on IIS on Server Core just as easily as if it was on the full Server 2008.
Windows Server Core is more complicated to set up for an absolute amateur, but you can use many powerful command line tools.
In addition, if this is on a domain environment, you can use a full range of MMC based tools and target the computer remotely.
There is also a tool called "Core Configurator" which I would highly recommend.