If your goal is to only get security updates unattended, without updating all the packages, you need to point to Debian, as Raspian does not maintain a separate security distribution. If you point to Raspian you'll update everything which is more likely to break something.
As to the question of how safe it is to have truly unattended security-only updates from Debian onto Raspbian stretch, as in how (un)likely are they to break something, I hope someone else can answer that. I'm facing the same question. I speculate that the contributors for Debian are good at deciding which updates can percolate unattended, but I lack the depth of knowledge to consider how likely those updates are to break something unique to Raspian. I can say that Ubuntu, which is another derivation of Debian, has a distro-specific security update repo, because my Ubuntu 50automatic-upgrades configuration file points to it, but I don't know what Ubuntu does to serve that repo. Do they test the Debian upgrades themselves before populating their distro repo (implying that Raspian not doing the same thing introduces risk), or do they just point to the Debian updgrades (which would imply the Raspbian behavior is safe)?
While assumptions and speculation are generally bad form for answers in a forum like this, nobody else has answered this question. I hope someone else with more knowledge can provide a better answer.