Is standard RADIUS safe enough to use?

For EAP-TLS, yes, if you look after two things. The certificate and the keys from it are exchanged inside the TLS handshake, so someone watching the RADIUS packets can't read them. They can see which device asked, which access point or switch it came through and the result.

The two things are the shared secret and the network path. Treat the secret like a password. Passbeam generates a long one for you. Don't reuse it between sites or paste it into a ticket. And use a network path you control where you can.

Passbeam ignores requests from any address that isn't registered for a site, before doing any other work, so a scan from the internet gets nowhere. Even so, RADSec is the better choice. Use standard RADIUS where the equipment doesn't support RADSec.