Should my wsgi directory be completely outside of www? 
DocumentRoot /usr/local/www/
WSGIScriptAlias / /usr/local/wsgi/
Something like that, yeah?
You don't need a DocumentRoot when using a WSGIScriptAlias /.
The answer to your actual question: it's probably best, yeah. I usually set the DocumentRoot to a 404 folder (folder with an index.html that shows a 404 page) and the WSGIScriptAlias to the actual script. Whether the 404 folder is actually useful? No idea, I've never seen it get hit. However, it's a good idea to keep them separated to avoid direct access to the contents of your code... which is something I have seen happen.
mod_wsgi directory outside of DocumentRoot?