Questions
# 2 You can serve both HTTP and HTTPS from the same ArcServer instance, but you could also serve your public content over https as well.
Where we have to install SSL certificate at web adaptor or NLB and do we need to install or configure anything at arcgis server site
You will have to install the external cert at your reverse proxy (or whatever is your outermost point). If your NLB is just passing on traffic and not reading the content, I'm not sure whether an internal cert is required, but your IIS Web Adaptor and ArcServer boxes need internal or self-signed certs to be installed.
Make sure you pass this test SSL Checker - SSL Certificate Verify