Reference:
https://docs.microsoft.com/en-us/azure/active-directory/develop/msal-overview

Reference:
https://docs.microsoft.com/en-us/office/dev/add-ins/word/word-add-ins-programming-overview

Explanation
A client application gains access to a resource server by declaring permission requests. Two types are available:
"Delegated" permissions, which specify scope-based access using delegated authorization from the signed-in resource owner, are presented to the resource at run-time as "scp" claims in the client's access token.
"Application" permissions, which specify role-based access using the client application's credentials/identity, are presented to the resource at run-time as "roles" claims in the client's access token.
Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/developer-glossary#permissions

Explanation
Graphical user interface, text, application Description automatically generated

Box 1: Yes
Using the isolated web parts capability, you can build web parts that securely communicate with APIs secured with Azure AD without exposing the access token to other components on the page or even scripts in the tenant.
When deploying these solutions to the app catalog, all API permission requests are specified as isolated.
Box 2: Yes
Even though on runtime isolated web parts will be loaded inside an iframe pointing to a unique domain, you can communicate with SharePoint REST API, the same way as you would in non-isolated web parts.
Box 3: Yes
If you're upgrading an existing SharePoint Framework project to v1.8.0 and want to use the isolated permissions capability, you can do it, by setting in the config/package-solution.json file, the isDomainIsolated property to true. You should ensure, that your project contains only web parts.
After changing the project to use isolated permissions, you should redeploy your project. This will issue new API permission requests, isolated to your solution, which will need to be approved by the tenant admin.
Reference: https://docs.microsoft.com/en-us/sharepoint/dev/spfx/web-parts/isolated-web-parts