LAN architecture + ISA Server

Hi,
I have 3 questions concerning the architecture of my Private network. My entire network is running Microsoft Product: 1 Windows 2000 Professional Server, 1 Windows SBS Premium 2000, 1 Windows SBS Premium 2003 and a bunch of XP licenses.

1- My network is composed of a main domain controller server and an application server which is part of my main controller. I want to add another server that is going to be my Web server. Should I create new domain controller for my Web server or just create a second domain controller that will be part of my main server. (Check jpeg attached).

2- I would like to secure the network with ISA Server. My Network router is already filtering my LAN but I would like to install a Proxy server to enforce the security. What architecture will be the best fit for my network? Should I installed my ISA Server on a standalone machine or installed ISA server on my main server and on my Web Server?

3- My Web server will be running SBS 2003. I will be the only one in the place to have access to the server except from the people from the Web side. So I should not bother buying anymore licenses for the other user of my network. Am I right here?

Thanks a lot!