1. No, I've done this. However I've usually had a "group" that has access as sysadmin. My view is that domain admins should have access. If I need remote hands, I need them. However some prefer it's just DBAs.

2. I tend to ensure each instance manages /monitors itself. While it's good to have something like SQL Monitor watching the environment, if I lose connectivity or my monitor machine goes down, I want some things monitored on the local instance. While sending policies out from a central place makes sense, I find I have to allow for lots of exceptions. I also want some things like backups, space, some stats captured locally, regularly, but each instance.