My own public “root” is named ‘public_html’ (at BlueHost), and yours at your own host might be ‘web’. The key issue there is whether your domain.com (whatever its actual name might be) is assigned to land at ‘web’ where ‘web/wordpress/’ can be found by domain.com/wordpress/ in a browser’s address bar.
I typically make my own database, user and such and then add that info to a new wp-config.php file for each installation, but you will not be able to do that without cPanel > MySQL. So, it looks to me like your only option is to let WordPress “self-install” with defaults for now. Also, an SFTP connection is more secure (no caching) if that is available, but you will only be using your FTP/SFTP connection for basic files and not for any highly-sensitive info until/unless you might eventually need to edit the wp-config file WordPress will make.
After you get WordPress running, I highly recommend BulletProof Security (plugin) for “hardening WordPress”, and then BulletProof will show you some recommended permissions you can change via FTP/SFTP for some additional overall security.