Box 1: No -
Virtual networks are not allowed at the root and is inherited. Deny overrides allowed.
Box 2: Yes -
Virtual Machines can be created on a Management Group provided the user has the required RBAC permissions.
Box 3: Yes -
Subscriptions can be moved between Management Groups provided the user has the required RBAC permissions.
Reference:
https://docs.microsoft.com/en-us/azure/governance/management-groups/overview
https://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-management-groups-and-subscriptions