The answer really depends on your expected use and whether you want failover. From the design, it looks like you are expecting alot of users, few tasks. I recommend installing the QMC on all your QVS servers (for fail over) and running it from one of them. In my experience there is no need for a dedicated QMC server.
You should test the capacity of your publisher server. We are using high RAM/CPU physical servers and can refresh 40 or tasks concurrently.
Check with Qlik for the NAS. They have recommendations as to the configuration. We currently use a windows cluster of the QVS as a file server for a SAN but I would like to move to a dedicated file server.
