No, you need to delete the .git folder from your server entirely. Ideally, delete it before you deploy. In fact, don't even put a github deploy key on the server. Deploy binaries.
And don't just stop with .git: Delete any folder/file that's not required to operate the app in production.
Yup. I used to host .git on a server but it ended up being more complication than it was really worth. Now I just have a “deploy” script that uses sftp to push all the build artifacts (and nothing else) to the server.
And don't just stop with .git: Delete any folder/file that's not required to operate the app in production.