Explanation

Box 1: Yes
Using the isolated web parts capability, you can build web parts that securely communicate with APIs secured with Azure AD without exposing the access token to other components on the page or even scripts in the tenant.
When deploying these solutions to the app catalog, all API permission requests are specified as isolated.
Box 2: Yes
Even though on runtime isolated web parts will be loaded inside an iframe pointing to a unique domain, you can communicate with SharePoint REST API, the same way as you would in non-isolated web parts.
Box 3: Yes
If you're upgrading an existing SharePoint Framework project to v1.8.0 and want to use the isolated permissions capability, you can do it, by setting in the config/package-solution.json file, the isDomainIsolated property to true. You should ensure, that your project contains only web parts.
After changing the project to use isolated permissions, you should redeploy your project. This will issue new API permission requests, isolated to your solution, which will need to be approved by the tenant admin.
Reference: https://docs.microsoft.com/en-us/sharepoint/dev/spfx/web-parts/isolated-web-parts