Addressing each part in turn:
1) This control protects against the following threat scenario: An attacker gets physical control of the machine's hard disk. They extract the local SAM database, which contains password hashes for the accounts on the machine and brute force them to get the passwords which they use to log onto another machine they do not have physical control of. SYSKEY works by encrypting the local copy of the password hashes and writing the encryption key to a floppy. You provide the floppy with the key on at system boot.
2) Any machine that isn't a domain controller only stores hashes for local accounts in it's SAM database, so it doesn't really change the attack if the client is participating in a domain or not.
3) Apparently SysKey just writes to whatever's been assigned the drive letter A:, so if you force a USB key to use A: in Disk Management, it'll work. The drive must be present and mounted at boot, so you have to use a floppy or USB disk, not a network share or device. You should also store the floppy/USB (and any backups you make of it) separately from the machine, since the threat is that physical control of the machine is lost.
Lastly, in more general terms, you're doing it wrong! You've implemented a control without knowing what it does. Do a proper risk assessment, understand the threat, then select the control.
It's quite likely, for example, that implementing full disk encryption and using strong passwords and tightening physical security on the device will be more than enough to manage the risk of someone carrying out the attack described above.