I believe the recommendation from Nutanix is to not back up the CVMs. If a CVM fails for some reason and does not self repair, you should be contacting Nutanix Support and it would be redeployed. Anything that was running on the failed CVM would have been restarted on the surviving CVMs.
I have configured Veeam v9 VBRs as VMs on the Nutanix infrastructure both as an External VBR (One hosted on a separate ESXi management Host) and a VBR that was hosted on the Nutanix hosts themselves. Both VBR are configured to backup VMs using the DirectNFS feature and both scenarios used physical Repository servers. I used dedicated a couple of Windows 2012R2 Core VMs as backup proxies for the External VBR on the Nutanix Infrastructure.
For the VBR server on the Nutanix Hosts (vSphere 6.0U2), we found that the VCSA (6.0U2) was stunned for a really long time losing connectivity to all the hosts when it was backed-up using the "hot-add" backup method. This issue is documented in this VMware KB Article (https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2010953
). Their resolution is to use NBD or disable hot-add. We resolved this issue by using DirectNFS backups for the VCSA.
Performance-wise before enabling DirectNFS, we were getting through-put speed of about 200MB/s max and a processing rate of around 100MB-150MB/s and this was on a 10GigE network. Once we configured DirectNFS, processing rate jumped up to 550MB/s and about 1.1GB/s through-put and it stopped the VCSA stun issue as well.
To configure DirectNFS for Nutanix, I followed this blog post on configuring something similar for iscsi storage backups (https://www.veeam.com/blog/direct-san-access-tips-for-iscsi-vmfs-volumes-and-backup-proxies.html
). Yes its for Veeam v6 but the principles still apply and all my backup are using [nfs] to backup my VMs.
Essentially what you do is provision a VM (in accordance with the backup proxy guidelines) with 2 Nics, one in the svm-iscsi-pg and one in the Server network (or dedicated backup network), default route out via the server/backup network (can be joined to a domain and run Server 2012R2 Core), add proxy to the Veeam console, configure "Preferred Networks" in the "Network Traffic --> Global Network Traffic Rules", whitelist the proxy IP in PRISM and on the next backup run the VM snapshots will use the [nfs] storage backup option. Leave the proxy transport mode as automatic selection on what to use.
For my VBR server on the Nutanix infrastructure, I configured a second VMXNET3 nic into the "svm-iscsi-pg" port group with an IP in the 192.168.5.x Subnet (not .1 or .2), whitelisted that IP in Nutanix and configured the "Preferred Backup Network (192.168.5.0/24)". Don't forget to disable the LRO on the ESXi 6.0U2 hosts (PSOD vSphere 6.0U2 https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2144968
) and resolve the active snapshot limit (https://forums.veeam.com/vmware-vsphere-f24/active-snapshots-limit-reached-for-datastore-t19711.html