This question is pretty loaded. I will try to address each piece:
main reasons for LLS is to prohibit a component from issuing undocumented API call
Lightning locker service(LS) it a security layer for custom lightning components and not for VisualForce components. Lightning components can be used in a VF page using Lightning Out. Regardless of how a custom lightning component was loaded on a page, they will be protected by locker service(if they have an API version of > 39.0 and opt into locker)
So yes, LS will prevent such components from making undocumented api calls.
The full list of supported browser APIs can be found here http://documentation.auraframework.org/lockerApiTest/index.app?aura.mode=DEV
external webservice via JS written inside a VF page.
The org administrator still controls what end points can be whitelisted. You can find in the setup section.
Hope that clears up your doubts.