Since you are new to Cisco secure endpoint, I suggest looking at the best practices guides as well. Secure Endpoint Best Practices Guide - CiscoConfigure and Identify Secure Endpoint Exclusions - CiscoIf you find this useful, please mark it helpful.

It's more about the best practice when it comes to VA.Umbrella document mentions that only one VA is required per site. However, they recommend having an extra for redundancy purposes. From the guide "Note: Only one connector is required per Umbrella...

Do you have the users sync in duo?If not, then use this, https://duo.com/docs/azuresync

No, you don't. I have implemented the above without an authentication proxy server. Just with the azure ad.