1. Installing everything into a single server generally is not a good idea, because the load produced by every application (WSUS, Veeam proxy server, SQL Server, etc.) will affect the overall server performance in a negative way. Separating DC and DNS roles shouldn't make much difference.
2. Yes, it will be able to see the tape drive, however if you're going to use pass-through capabilities, then it will not be possible to migrate this VM. There is another preferred way to expose your tape device to the backup server. See this topic for further reading > Veeam on vSphere vm > backing up disk to tape via iSCSI
4. Please see our system requirements for each backup component in this document > http://www.veeam.com/veeam_backup_7_0_r ... tes_rn.pdf
5. Using a dedicated machine for a backup server is, indeed, a good idea, so if I were you I would go this way for sure. With physical backup server you will be able to connect your tape device directly to the server, without using any workarounds and tricks that I have mentioned above.
Let me know if that helps!