So recommendations on separation of BES services (i.e. root vs. WebUI) is highly dependent on the number of managed endpoints, number of concurrent operators (both BES console and WebUI) and several other factors. Generally speaking, it’s a best practice for medium-to-large enterprise to separate user-facing WebUI and WebReports from the root BES server and core BES services (i.e. BESRootServer, BESFillDB, BESGatherDB).
If you provide additional details regarding your environment, I’d be happy to provide additional guidance. If you’re not comfortable posting those details publicly, send me a DM and we’ll chat privately.