Welcome to the Microsoft Q&A (Preview) platform. Happy to answer your question.
Azure AD App Proxy and Azure ADDS are independent features and are not dependant on each other.
Azure AD App proxy works directly with on-premises applications and is better suited in your scenario. Azure ADDS supports Kerberos authentication on devices which are joined to the domain joined to the domain in AAD DS.
- No, you do not need all the 3 services.
- Yes, KCD is supported directly with App proxy. Reference this document.
- It will work only with the machines which have a line of sight with the DC's internally. It will not work over the internet.
Please let us know if you have further questions.