With SDWAN, if there are 100 branches share common config and policy attributes, 1 profile would be sufficient.
If an external firewall exist at a site, a VMWARE SDWAN Edge can be placed - Between Firewall and Internet circuit, Firewall and LAN switch, or In the DMZ parallel to the firewall...