Separating IIS for multiple CommCells, requirements

Planning/doing a HW and OS refresh for all CS’s. Best practice for security is to separate IIS from the CommServe if reading latest recommendations correctly. Does the Webserver require an instance of it installed for every CommCell it talks to?

I read this thread on the topic but it doesn’t seem to speak to multi-instances.

Also, referring to this webserver requirements page, I thought the concept of security was to separate the DB from IIS. That page infers that the DB must be installed on the Webserver???

Can you guys clarify A) whether splitting IIS off requires MSSQL locally and B) multi-CommCell’s require separate webserver instances or VMs?

thanks!