Is this the correct way to permanently set the ulimit in Debian?

Manually I can set via ulimit -n 20000 the file descriptor limit and it works fine. To have this limit for every user also after a restart of the machine, can I add

*                soft    nofile          20000

to /etc/security/limits.conf?

I can't try because I can't really restart the server.

Yes. This is one of the correct ways. Another way is setting fs.file-max in /etc/sysctl.conf.

But wait, no need to restart your server to checking, run ulimit -n 20001 from the command line, logout and login back, then re-run ulimit -n to see what happens.

I think it is best way. Looks good for me