I can answer a couple of your questions at least
(1) No, there are only two configuration slots, but you can program a Symantec VIP credential on the OATH applet, like with the NEO -
viewtopic.php?f=26&t=1617#p7058 (2) Check your settings, by default screensaver doesn't require a password to return from initially (I believe there is a default delay of something like 5 minutes). Change this to immediate and test again.
(4) No, HMAC-SHA1 Challenge-Response will only work locally, it has to be plugged into the computer you are logging in to.