I’m referring to the self hosted part. The outside world can send pull requests via the public GitLab mirror, or they can actually also access my self hosted GitLab instance via its public address - although I doubt anyone would bother.

(Pull requests also can, and should, be sent via ways such as submissions to mailing lists.)

It's a mirror so you'll want to merge the pull requests on your self-hosted instance probably, don't you?