Your Summary is correct. One server in the DMZ for SG/WI, and the two on the internal network can have Presentation Server.
If you need to use the Secure Ticket Authority (STA), you can install that on any machine that has IIS on it. It is only a small .dll that you add and you probably don't need a whole server dedicated to just the STA. I think it can handle something like 10,000 connections a minute so with the scope you mentioned, just put it on any internal server you have with IIS.