For the most part I think you have identified the pros and cons of the individual portals vs. individual installations.
I guess the only other thing is that with individual installations you can easily move them to a different server, or a different location something that isn't as easily done with individual portals.
The other big thing is that you can also segregate the databases for each DNN installation that might help with performance as well.
The one con that you don't have listed is diskspace, with individual DNN installations and db's for each invidiual installation the installation route would provide you with a much larger disk utilization as well as requiring multiple databases, or a VERY complicated database with hundreds of object qualifiers.
Overall I guess it is very hard to make a blanket assumption or judgement about which method is the best. If you want, e-mail me and we can discuss a bit more away from the forums if you are interested in my opinions.
As for your other questions.
You might want to consider AD (Active Directory) integration if you have a backend system that already exists outside of DNN as it is really the only easy way to achive a "single sign on" with DNN and other applications. (Aside from modifications to your external app to bind it to DNN...)
As for the permissions and overall backend. I would recommend that if possible you might move your backend into DNN as modules. In the long run if you are wanting to use DNN as your method for building the sites it might be best to set it up right and fully integrated, it could save you many headaches later!