Hi Lisa,
> Our current thoughts are to put Server and Portal on one machine with a Data Store on a separate machine.
We recommend that you install Server and Portal in separate machines. In this way, if Server is really active or busy, it will not affect the performance of Portal.
> Portal with a Web Adapter will essentially do most of what a stand-alone (without Portal) Server with Web Adapter will do
Not quite true. Portal for ArcGIS requires a Web Adaptor to work, while the GIS Server can optionally use the Web Adaptor. Reasons why you would may want to use the Web Adaptor:
- enables web-tier authentication
- provides more flexibility to control access to the Server site
- you can leverage web server features
- it is conceptually like a reverse proxy for the Server site
> Does anyone know if I can still access the MapSevices directly using the Portal with Web Adapter, or will I need to install a separate WebAdapter for Server?
This will greatly depend on the security model you configure for your Server site and for Portal for ArcGIS. To be clear, Server and Portal have 2 separate security models, you can optionally "federate" your Server site with Portal so that it uses the same security model as Portal.
Within the context of your situation where you have an existing web app that is currently referencing web services directly from the Server site, you can "switch" it to access web services from your new 10.4 Server site, but Portal would not be a factor in your deployment. If you decide to change the web app to work with Portal, then you should evaluate what security you would like to set for the Server site.
A good starting point for understanding Server/Portal security:
ArcGIS Server and Portal for ArcGIS: An Introduction to Security | Esri Video
Hope this helps,