Please challenge your IT and ask them to setup dispatcher in front of AEM author instance. It is always better for performance and security reasons to have dispatcher in front of AEM. Dispatcher setup does not take much time and is more easier to manage as well. 

Don't do any changes to white list the host or allow anonymous requests. It is not a recommended option and is not best security practice. You can solve your problem by including CSRF framework clientlib on the page where you have created your form. ClientLib category is -  granite.csrf.standaloneMo...

AEM communities is an add on product to AEM sites and requires a separate license to be purchased before you use it in production. Contact your Adobe account representatives to know more about the license cost.

My recommendation would be to store it under /content node only as this data represents content. AEM 6.4 onwards it is recommended to move all content nodes from /etc folder to /content folder. Any code under /etc should go to /apps or /libs folder.This is important as per new AEM cloud as a service...

You can use Asset share portal for sharing assets securely and anonymously with external partners or users who are not AEM users. The asset share is a regular AEM site and you can integrate with any authentication provider as per your needs. Since asset share is open source reference implementation,...

I would like to implement following use case using AEP -1. Capture user behavioral data while he interacts with the website. 2. If a user shows an interest in a product then add him/her to a particular segment. 3. If user has qualified for a segment in Step#2 then show some personalized message or o...

Check the following excellent blog on pros and cons of AMS - http://www.jetteroheller.com/adobe-managed-services-vs-self-hosting-aem-pros-cons/

Do you see any errors in datastore GC job logs in error.log file ?

One option for you is to block all .json URLs and whitelist the ones which should be allowed. If you have any resource type based servlets then you could register them with a custom selector along with JSON extension.

You should have enabled stitching of customer IDs and visitor Id's on your website. If sync is enabled then AAM should be able to ingest the offline users via feed file and associate them with the traits etc. See this - https://forums.adobe.com/thread/2353762