Is it possible to have the N2 folder as a separate app, with the goal being http://cms.mysite.com is hosted separately to www.mysite.com (for security reasons)

Yes. You probably want to set up cache invalidation between the sites (e.g. using sql server dependency).

Please could you elaborate a little on "set up cache invalidation between the sites"

Thanks

I don't remember exactly how you set asp.net sql cache dependencies.

In N2 you can configure <database sqlCacheDependency="somedependency". This will add a sql cache dependency to objects cached by N2.