The short answer is "Follow the documentation". I would say 95% of implementations are distributed between CM and CD machines (and often more with dedicated GUI, Search, Publishing and DB on the CM side), normally with a firewall between them and the CD side (which is built for even more distribution between caching, deploying, rendering and presenting content). You will find plenty of scenarios online.

The only real communication between them is the transport service and topology manager which normally uses HTTP/HTTPS, so make sure those ports are open. Out of the box the CM talks to Discovery and Deployer, which typically run on port 8082 and 8084 respectively.

If these machines are not both behind a firewall I would recommend running all of the CD services with HTTPs. I have found the easiest way to achieve this is to make one endpoint (something like "https://cdservices.mydomain.com", and set up URL routing to send the CD calls to different micro services as follows:

https://cdservices.mydomain.com/Content   > http://localhost:8081
https://cdservices.mydomain.com/Discovery   > http://localhost:8082
https://cdservices.mydomain.com/Deployer   > http://localhost:8084

This means you only need to open one port (443) in the firewall, which simplifies setup.