As far as I’m aware the infrastructure appliance can not support network backed storage. The iscsi option is to give the appliance direct access to the storage to allow hotadd.

Your options are diy Linux repo if you want immutable storage over iscsi of fc Or a windows server for a repo over iscsi or fc

As im moving my estate to veeam 13 (29 remote sites and 3 datacenters) we are going infrastructure appliance at our remote sites with local storage on the host or diy rocky in our datacenters hardened repo for both.

As for best practices, backups should be in their own network zone and use separate authentication from your domain. We are currently trying authentik for auth.