If requiring High Availability, you need to use some sort of load-balancing solution (not provided by CA Technologies).
CA Technologies provides an install script to configure Nginx as a proxy for HTTPS requests, Nginx could also do some sort of load balancing. But no configuration is provided for this by CA Technologies.
Basically, if you put a DxC on a collector as it is bound to impact performance of the collector.
If the users are external, you need to be able to send data from their browser to the DxC itself. This means you need to open up the firewall to let the data in, or have DxC outside the firewall.