No, you have a single installation that is set up to manage all of the sub-sites. Thats the beauty of it - when you're a "super admin" you can manage all of the sites, and you can set up administrators for each site that can only manage their own site.
As for the passowrd protection, no I don't have any recommendations. I don't use anything like that for the sites that I've had to build so far.