Your mysql database should have a root password. Not your system root password but a dedicated mysql root user password.
If your system is behind a router or some other machine (and it definately should be) the databases communicate with each other locally and you can keep ports closed in your router until you are satisfied with your setup.
The users we add to the master are like this:
root at 192.168.1.100 with password
root at server2.example.com with same password
Then you can log into phpmyadmin and remove those two users when you have finished installing ISPConfig3
To open and close ports in your router then you can use a browser to log into your router interface. given above example the address would be 192.168.1.1