Lot's of questions there. I'll give my two-cents on them.
one more question do they release developer edition with online WAB edition?
I'll answer this one first. AGOL (Online) will always have updates first. WAB-developer edition usually has a new release with most/all of the updates within 4-6 weeks (or sometimes less). The onsite Portal will always be behind that and is currently still at least one update behind from what I understand (I do not have the local Portal installed).
i don't think the delay for the dev edition is an issue since it any newly introduced bugs/issues with the online version are sometimes found and corrected, or a workaround provided before the dev edition is released.
My recommendation is to use the developer edition for the flexibility of adding additional customization. although the AGOL version does seem to adopt some of the user provided customization, my guess is some will never be incorporated.
For security, I would take advantage of you ArcGIS Server security options, and use a proxy to provide access to those services if needed. with that, you can keep all you data and services on premise, and just use AGOL to "pass thru" the URL to the services. developer edition also has a custom widget available that allows you to use you "local" ARcGIS Server services.
To see some information and updates on many of the WAB versions and custom widgets, I have a blog post that is updated regulary
/blogs/myAlaskaGIS/2016/03/09/web-appbuilder-developer-edition-customization-resource-list?sr=search...
which also has links to install tips, although the help has been improved too.
also, make sure you check out https://community.esri.com/groups/web-app-builder-custom-widgets?sr=search&searchId=493c23ae-16a9-49... for news on customization and widgets.