Grab a beer and settle in, it'll probably be a long thread!

So I picked up a Synology DS920+ and here's what I want to do with it. I have (2) 4tb Seagate drives to start with just to get it set up then I'll add (2) more 4tb drives after all my media is moved. This NAS will allow me to run VM's so I definitely want to take advantage of that and because of that I want it to be as secure as I possibly can make it.

Now the goods -

1 - I plan on setting up 3 pools; the first around 500gb for the virtuals, second around 50gb for small backups from my laptop and third will be the rest used for my media server.
1a - If something funky gets in my VM can it get to the other pools?
1b - I have friends that connect to my Emby media server so currently 8096 (I think) port is forwarded through my router. Will making this as secure as possible cause an issue with that or that port being forwarded cause an issue?

2 - I plan on using Synology Hybrid raid.
2a - It's my understanding that adding drives after the SHR is setup will allow me to tell the SHR where to allocate the new space, right?
2b - Do I need to tell the SHR what type of raid I want to use or will it determine that on its own?

3 - I'm pretty sure Synology has an antivirus package that I can choose to install.
3a - What exactly does that cover? I would still need to have an AV on each virtual machine, right?

It's late and I'm tired so that's all for now.