For my dapp, I want to host a web server (Geth + web3) which allows the users to relay the transactions they signed "offline". Is this safe? Are there other (than unlocked accounts) security concerns with RPC?
Yes, in principle it should be fine. Your main concern would be DoS and people sucking up bandwidth, but this only aggravates a concern you already had when running a node, even without opening up your RPC interface.
That said, if you have any resources on the web server that do need to be secure (eg if you have keys managed by some other process that you're using to sign the transactions that you're ultimately sending to Geth) you might be better running Geth on a different server; It shouldn't matter if everything works as designed, but having this extra service open to the world inevitably broadens your attack service.