It'll be a CC600 then, yes the main system should have the firewall enabled with port rules already in place, so only thing you may need to change is all 4816 communication on your network, as this is used for most of the system (4816 being the InVentry API port)
Can't say I've heard any issues with this so you should be good to go, on that front.
The passwords out of the box are default ones, but these can be changed providing you let the install engineer know or the support team, as only a few things need amending to change this (Services and login details mostly)
It can backup remotely as it's just a SQL backup so as long as it can reach the destination it'll backup to, I know some sites do this to a onedrive, or Google Drive location, as long as Veeam has a location it can backup to that should work, depending on your site you may also get "Cloud" which sends up information so in a catastrophic failure, it can re-parity this data back into your system, it's not everything at the moment but currently does Visitor/Staff/Pupil events and records, so if you have a major issue this can repopulate a lot of the system with this.
Windows 10 IoT Enterprise LTSC 2021
-Tech