embed component for iframe

hello,

In a new project, we need to use an iframe to embed a web page from another site into AMS's AEM.

We plan to solve this using the ootb core embed component.

The web page we are trying to embed using an embed(iframe) is managed by the same group and is a web page created in asp/aspx and located on the iis web server.

We have a proxy embed component and embed.html under the proxy embed component.
And we modified it <sly data-sly-test="${embed.html}">${embed.html @2941342 = 'unsafe'}</sly>.

We are going to use URL and HTML.

I think we need to modify /libs/cq/xssprotection/config.xml, but my questions are:
1. Is it possible to overlay with /apps/cq/xssprotection/config.xml?
2. If overlay is possible, should we include this as our source code and do source control with other code?
3. What parts should be modified/added in this file in order to embed web pages using URL and HTML ways?

thank you