If you want your guard node to be helpful in anonymizing your traffic, you should really make sure it's public and used by some % of the global user base (so that your traffic blends in the noise). Once you do that though, you will always have to trust that node a little less than you could if it was walled-off so it would only serve you, just because it is another machine serving connections on the internet that will likely be targeted by adversaries who would benefit from turning many of the guard nodes into part of their Tor de-anonymization service.

If I had endless resources and was truly paranoid, what I'd do is build my set of public guard nodes, make sure they're serving Tor traffic, etc. But then, I'd "borrow" those IPs occasionally for trusted nodes which will only accept connections from me (ideally both sets of machines will be live and routing traffic simultaneously).

In theory, you could apply the same tricks with similar success to exit nodes of course (though as usual, running an exit node is generally a slightly riskier / harder thing to do)