IMAP and Exchange 2013

We have an application that requires the IMAP protocol enabled for receiving email.  I have been tasked with enabling IMAP for a particular mailbox, and the servers where the Active and Passive mailbox copies live.

Our enviroment:

10 Exchange 2013 servers all  holding the same roles.  5 servers live in the EU datacenter and 5 live in the US datacenter.  The EU servers have there own DAG, and the US servers have their own separate DAG.

What is the best approach for enabling IMAP for a single mailbox that resides in the EU?

Can I isolate the enabling of IMAP to just the EU servers that hold the active and passive copies of the mailbox or does IMAP service need to be enabled across all servers (EU/US) in the Exchange org?

Can IMAP just be enabled on these two servers and single mailbox, and can this single mailbox still receive emails from other internal mailboxes that reside on the same EU DAG, and receive email from mailboxes that reside on the US servers / DAG?

How can we close other security holes that are opened when IMAP is enabled?  Network Firewalls along with disabling IMAP for all mailboxes across all servers, except for the mailbox that requires it?

Any feedback or suggestions would  be greatly appreciated.