Web services tier/server deployment

I have a general web services deployment question regardless of technology used.
>Currently 3-tier architecture is setup in production ....
  Web tier - web application/pages
  App tier - business logic and data access
  Database tier - holds the business data

We have created a layer of services based on SOA methodology for exposing our business functionaly/process. These services will be accessed by the web tier to connect to the business layer and also by external clients/vendor to interact directly with the business API.

Where is it best to deploy the web services ...
1) on App tier which then exposes business logic directly to outside environment but only to authorized users
2) on both Web and App tier so that external clients only get access through web tier
3) create a new web services tier which is accessed by both web tier and external clients to connect to business layer.
4 ) others ....

each option has its own pros and cons based on security, performance and maintainability. I would appreciate any insight on how best to approach this and how its done in the real world elsewhere (how do you deploy services currently ?)

Thanks