Tracing dashboard publish settings from input form in WordPress

Those are some dangerous words “public…can enter data directly to the DB”

You could write your own form and use wp_insert_post()

Something like this:

$new_post = array(
    'comment_status' => 'closed',
    'ping_status' => 'closed',
    'post_author' => 1, // id of admin, or some other user
    'post_title' => $_POST['title'],
    'post_name' => $_POST['title'],
    'post_status' => 'draft',   
    'post_type' => 'post', // or whatever   
    'post_date' => date('Y-m-d H:i:s'),                         
);
$new_post_id = wp_insert_post( $new_post );