1. The requirements from a licensing perspective are documented in the Data Fabric Solution for Cloud Backup Workflow guide, which describe the licensing requirements for ONTAP. Having a SnapVault license is fine, assuming you have ONTAP 9.1.
2. SnapCenter supports only NAS workloads to AltaVault today. VM and database workloads are coming in future releases.
3. That is correct . You do not want to replicate snapshots to cloud AltaVault over the WAN without encryption, which is not performed during the Snapshot replication.
It would work, but probably wouldn't be supported as a viable use case due to the risks involved with the data being out in the clear, as well as the data transmission costs of data not being storage optimized prior to transfer over a WAN.