It's a good question.
With Security Server it was often necessary to dedicate Connection Servers to either internal or external so that the external ones could be configured for stronger 2-factor authentication. Security Servers are tied to individual Connection Servers.
Now with Access Point, this is no longer necessary. Access Point can still be linked to an individual Connection Server (just like Security Server), but a better way is usually for Access Point to connect to a load balancer in front of multiple Connection Servers, and for those Connection Servers to be configured the same for both internal access or external access. Even if you do want to move to strong 2-factor authentication for remote access users, this still works as you can now move the 2-factor authentication to Access Point itself and leave all the Connection Servers to do just password authentication.
Some admins will still want to dedicate Connection Servers for internal or external if they want to use tagging to manage different entitlements for internal and external users, but in general, with Access Point, Connection Servers don't need to be dedicated.
