Please excuse my quick browsing of you extensive text, but I hope I can point you to most important issues and show you, how I did it myself a similar setup, but even with multiple databases. The following describes how I made it work in my environment. There may be other ways, there may be flaws, but it works.

Remarks (or my personal opinions/experiences):

- You are correct, when using related companies and manage relations to a parent company, multi-company is the way to go
- Do not use a Bitnami image, install it yourself, it is easy enough (read the documentation).
- Do not use a VM (what for anyway?), if it is important, use Docker
- You are right, there is no need for Apache, Odoo has its inbuilt web server
- Use a reverse_proxy for SSL termination, but install it on a separate server in the subnet, which has a firewall open to the public (ports 80, 443). Depending on the traffic, a t2.nano EC2 is a good starter.
- install Odoo on a server in a private subnet without public access, allow access only to the reverse proxy
- if you don't understand nginx (for me it's too complicated), use a Caddy Server, which is much easier to use

dbfilter:

dbfilter is a Regex-based mechanism to translate the hostname of an incoming http-Request (i.e. https://www.example.com) to one or more database names. Please use Google to find more information. The most common use case is to set a database name, which relates to a subdomain of the hostname, example: database name is "odoo", the hostname is https://odoo.example.com.

In your case, you can set the dbfilter hardcoded to your database name, or you can use the OCA module dbfilter_from_header to keep the opportunity to still use more than one database. The module is available for Odoo 13.0, but you can simply change the version to 14 in the __manifest__.py file and it works.

How to do it:

- In Odoo Website Settings, set the proper domain name to each website, example: www.company1.com, this is also the vhost name you have to define in the reverse proxy

- In the odoo.conf file set dbfilter to your database name (dbfilter = databasename) or , when you use the module dbfilter_from_header, let pass everything (dbfilter = .*). Set proxy_mode = True. If you use dbfilter_from_header, add it to the list of serverwide modules.

- Here's the settings in the default odoo.conf file:

[options]
...
...
...

dbfilter = .*
proxy_mode = True
...
...
server_wide_modules = base,web,dbfilter_from_header
...
...

- and here is a sample vhost declaration (Caddyfile) you have to define for each website domain:

company1.com {
    redir https://www.company1.com{uri}
}


www.company1.com {
  reverse_proxy http://168.xxx.xxx.xxx:8069 

    header_up X-Real-IP {remote}
    header_up X-Forwarded-Proto https
    header_up X-Forwarded-Host {host}
    header_up X-Url-Scheme {scheme}
    header_up X-Odoo-dbfilter databasename
    }

  encode gzip zstd
  file_server
  log {
      output file /var/log/caddy/caddy.log
  }
}

Please be aware that Caddy Server automatically provides and renews SSL certificates, so there is nothing else to do, it is as simple as that.