AWS - public IPv4 cider block

You can attach multiple ENIs to EC2, but does this mean that the number of ENIs is too small?
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/MultipleIP.html

Also, I believe that using a CNAME record or similar would allow access to multiple domains, but can't this setting be addressed as well?

I would be looking at building an inspection VPC using gateway load balancers to route internet traffic to your inspection firewalls and then onto your applications if using a “traditional” firewall such as checkpoint.

Something along these lines https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-inspection-third-party.html

Or

https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/inspecting-inbound-traffic-fa.html