Re your point 2 You are heading in the same direction my company has gone. We have the equivalent of your 'Central System' as a Username, and have created three folders on its Drive - WORK, REFERENCE, EXTERNAL USERS - and shared them with our Sysadmin. Sysadmin shared WORK with Users on an Edit basis and our users built a sub-folder structure for our company to hold all our working files. Sysadmin shared REFERENCE with most Users on Read basis but with some Users granted Edit rights so they could create and maintain the folder/file structure for policy documents, manuals etc.

WORK is shared Edit and REFERENCE is shared Read to new starters as part of the User setup process and new Users immediately acquire inherited rights to all the contents of these folders.

Leavers, we change the User password immediately, use administration advanced tools to transfer ownership to their manager/colleague for any files/folders they may have created and then unshare them from WORK and REFERENCE.

We have not made WORK or REFERENCE to be the Owner of the sub-folders and documents which they contain because it would require that only someone logged into Central System would be able to delete them. We simply use our own version of Central System to provide a unified data structure for our Users. The Users each retain the 5gb of non-Gdocs storage space which is shared with other Users through WORK and REFERENCE.

We collaborate with external organisations and use EXTERNAL USERS as a portal. For example, our Auditors want access to our some of the data on our system. We created a sub-folder AUDITACCESS in the EXTERNAL ACCESS folder and granted our auditors' gmail accounts Read access to AUDITACCESS. We then use the Organise function to give them a View towards the files and folders which they need to access (but remember to hold the CTRL key down when you use the Organise function). This allows us to un-Organise files and folders, if necessary, since they are all listed in the AUDITACCESS folder and to un-share AUDITACCESS with our auditors email accounts, if necessary.

Hope this will give you a few ideas for organising your own system.

Short answer

AFAIK, no, thumbnails are not created by an external site, but Google uses a lot of websites to host their services. I don't know the specific one for thumbnails but to avoid this and other problems consider to unblock all the ones listed in the help article regarding regarding the firewall and proxy settings for Google Drive. Below is the link that article and the current content.

Google Drive firewall and proxy settings

In order for users on your network to access Google Drive on the web, Google Drive for Mac/PC, and Google Docs editors, your firewall rules should connect to the following hosts and ports. Otherwise, users may be blocked or denied access from these services.

For the following hosts, [N] means any single decimal digit and * means any string not containing a period.

• www.google.com:443/HTTPS
• accounts.google.com:443/HTTPS
• googledrive.com:443/HTTPS
• drive.google.com:443/HTTPS
• *.drive.google.com:443/HTTPS
• docs.google.com:443/HTTPS
• *.docs.google.com:443/HTTPS
• *.c.docs.google.com:443/HTTPS
• sheets.google.com:443/HTTPS
• slides.google.com:443/HTTPS
• talk.google.com:5222/XMPP (needed only for Google Drive for Mac/PC)
• gg.google.com:443/HTTPS
• script.google.com:443/HTTPS
• ssl.google-analytics.com:443/HTTPS
• video.google.com:443/HTTPS
• s.ytimg.com:443/HTTPS
• apis.google.com:443/HTTPS
• *.googleapis.com:443/HTTPS
• *.googleusercontent.com:443/HTTPS
• *.gstatic.com:443/HTTPS
• lh[N].google.com:443/HTTPS
• [N].client-channel.google.com:443/HTTPS
• clients[N].google.com:443/HTTPS

Important notes

• The IP addresses that various domain names resolve to don't necessarily fall within any given address range.
• Other Google properties may use the IP addresses that Google Drive uses.
• Techniques that Google Drive uses to connect to Google servers depend on the browser, browser version, networking conditions, etc.
• Even if you don't currently observe activity at the addresses listed above in a particular Google product there could be future activity.
• Google Drive for Mac/PC supports all unauthenticated proxies that are configured by the operating system.
• Google Drive for Mac/PC supports only DNS-based distribution of PAC files. PAC distribution over DHCP is not supported.