This question touches on many different aspects of Azure that would need deeper exploration before being able to give definitive advice.
However, if you don't have ADFS deployed today and are considering it purely for PaaS based SSO authentication services, then my general advice is to not deploy it at all.
Instead, as you suggest, I would configure Azure AD Connect - something you will likely do anyway, and then rely on Azure AD itself to be an identity provider. It has a broad range of integration and security features and is far simpler to manage than ADFS. And you can still extend traditional AD into Azure for IaaS services.
More details can be found here : What is application access and single sign-on with Azure Active Directory?
If you are concerned about passwords being stored in Azure, there is also no longer a requirement to use ADFS, instead look to Pass Through Authentication, more details here: User sign-in with Azure Active Directory Pass-through Authentication
Of course, if there is a firm requirement to deploy ADFS, then you can deploy that in Azure, with all the same principles you would have in an on premises deployment, including making use of a 'dmz' model through use of separate subnets and network security groups - as if you are using it for PaaS or even SaaS services, you may well eventually need some external access, better to build for that eventuality, even if it's locked down initially, than have to rearchitect later. You can find a link to the Microsoft guide on ADFS deployment in Azure here: Deploying Active Directory Federation Services in Azure
But again, my advice would be to explore further the capabilities of Azure AD itself first, it is built for the use case you describe.