There are many parts to your question, but I'll concentrate on one of the topics only and recommend you to check our DeltaV Security Manual to get additional information about how to define your DeltaV installation following security best practices. The manual is available in Guardian within the Resources section.

Your Plant LAN in a domain should be segmented from the DeltaV workstations 3rd NIC, and that is done by means of security perimeter devices such as firewalls so that you can build your L2.5 network (network segment below the added firewall) which is part of DeltaV, and then your Plant LAN will remain segregated right above the added firewall. The need for 3rd NIC connectivity (L2.5 network) will depend on your use cases - how you patch your system, how you interact with external historian servers, integration to other systems via OPC, etc. - all I'm trying to say is that depending on the use case for Plant LAN connectivity, it's important to have a perimeter security devices (aka. firewall) to reduce

DeltaV can be deployed in a domain, and in this case the domain controller is either the ProfessionalPLUS server or you can also have an Independent DeltaV Domain Controller from DeltaV v14.3+. Joining DeltaV to a foreign domain exclusively will impact your system's functionality - if at all work, no support is provided for this specific scenario.