Best practices is an ongoing question and discussion and quite frankly, from my experience, you are not going to get a definitive answer. This is probably because in most situations, a multitude of different layouts will work.
I spent a lot of time at the UC this year going to presentations regarding this question.
My interest is mostly with Portal as the center hub.
Even among Esri employees, you will get different answers as to best configuration.
The typical advise is to engage professional services for help with your design.
I finally realized that the best practice was too customized for each solution for that to be a definitive BP guide.
One thing that I kept hearing was: consider your data configuration location. If that goes down, your site goes down.
Ditto with your web adaptor.
So I've spent some time trying to get a handle on criticality and
Your layout looks fine to me.
I think many folks run the web adaptor on the main AGS box (physical in your case) without any issues.
We do this with 10.1 with no apparent issues (although as a caveat, I have one inherited massive AGS unit that needs a reboot with regularity. I think this is a more a javaw thing....)
Are you running IIS or Apache on there? And are you going to host web apps/sites on that box?
If you're only standing it up for web adaptor, seems like a possible resource waste. Would depend on how many hits you're having across the wire, etc....
Another thing to consider is Failover and Disaster recovery.
Then there's the question of security/SSL: are you federating or just leaving everything open?
A main point out of this years UC was that SSL used to be recommended best practice, especially with Portal, but now is basically considered required.
For me, diagraming is the thing to do.. You get a good feel for dependencies, resources, etc... that way.
Dave Peters offers a 3 day online course regarding Building a GIS and you could get his book, 2nd edition.
There is a head spinning amount of info there.
Portal is a whole other beast. In 10.3.1, the new Data Store comes into play as well as a hosting server and federation, etc... And as looks like you know, Portal requires its own web adapter. The forums indicate there are issues getting Portal and AGS to run on the same server with individual web adapters but that it can be done with care.
With your design, I think you could add Portal in without a huge headache, just would require another server or two. some folks run Portal, the Hosting Server and the Data Store all on one box along with the data config files. If any of those go down, you're Portal is almost down anyway. I suppose you could lose the Hosting and Data Store stuff and still have a Portal limping along using any resources registered from your other servers?
When I start considering all of this, I can see why one can't really get a BP answer.
My feeling is you do your best and set it up and go from there.
It does seem that one recommendation from a majority of Esri folks has been to put each major component on its own VM box as much as possible (and to create a fail over for it) That can consume a lot of resources though.
And I've heard and read that two individual VMs of say (2) cores and 8GB @ is better than one (4) core 16 GB vm box. But then, I recently read that the latter is the case from Esri's own info: Virtualization and ArcGIS Server—Installation Guides (10.3 and 10.3.1) | ArcGIS for Server
I suspect a lot of this doesn't come into play until you're one of the folks out there having to deal with 1000s of users.
