Design advice self service password reset

Hi,

I'm looking at a fim design for around 10,000 users with the following:

1 x sql server for fim portal DB
1 x fim server for fim service + fim portal
1 x fim sync server with sync service + sync DB

I need to incorporate FIM password registration and reset in as well. I'm unsure of whether to add the password reset and registration portal on the same server as the fim service and portal.

My understanding is that the main reason to separate the SSPR from the fim service and portal is due to external access for external users (i.e. security). However what I'm not sure about if external users are not relevant and if I'm to put SSPR and fim portal on the same server, then how should the IIS sites and app pools be configured? Will 3 separate IPs, IIS sites and app pools be required?

Thanks