On item 1 yes. I do this on existing project where we use the same application to represent different sites. These sites are based on sports so each sport has different rules and permissions etc.
On item 2 I’d build it as modules for maintenance purposes but really you should just use a pre handler to do permissions to access modules. You don’t really want to load and unload modules based on a site. You’re going to want leverage caching to scale it.