This is ok to have one metastore. You have several ways to restrict access to specific catalog by ACL or Bind Catalog to specific Workspaces. Please read documentation about Unity best practice 

Your organization can create like 3 catalogs for your project and you can bring 3 data lake storages dedicated for this project. The. You bind those catalogs to those Storages and to your Workspaces. Admin can give you ownership over catalog , so you can do wathever you want inside. 

All under one Metastore so your organization can manage all proejects centralny and if there will be need share data between projects in easy and secure way.

You don't split environments to different metastores, you do this on catalog level.

You can , but you dont have to split environments per Storage Accouns, you can split it e.g. on Container level.

There are multiple architecture but I encaurge you to spend some time with docs. 

https://docs.databricks.com/en/data-governance/unity-catalog/best-practices.html#organize-your-data