The only reasons to create a separate AD domain is to have a different password policy, to segment replication.
You can minimize risk of a compromised DC only by having a new forest. Any domain in a forest can result in compromised Enterprise Admin credentials.
The ADFS server must be trusted by both domains, so a Domain trust or a forest trust is needed. If you don't do this, then home realm discovery will become difficult.
If you intend to use MSFT online, Azure AD for synchronization, multiple domains and forests are supported but it's more complicated. Just know that when you provision in one location (US) it doesn't allow you to share the same namespace in the UK. (e.g. firstname.lastname@example.org is country specific). This is a temporary limitation that will be corrected soon.
ADFS vs Ping vs Auth0? Well who are you integrating with? What are your in-house skills? do those providers have the PII protections you require?
Yes, AD can scale to over a million of objects (the US Army/Navy has a massive AD forest). This info is from 2007 so I'm sure it's much higher now.
Question for you - what do you have resources for: one perfectly robust AD infrastructure, or two infrastructures? (e.g. isolate the outages/load)