If you just want to put access  limit to files and resources or services,
you do not need to deply and run your application  on different servers.
You can use JBoss security  and login  modules for put access limit on resouces and services  in both web layer and ejb layer. You can define and configure users and roles for your system and configure resource access policy for web resources and components using jboss login module for web layer. Also you can do the same for services in ejb layer and identify the services that each user with specified system role, can access and execute. If you have a constraint to run system on different servers, you can use ejb clustering that JBoss proviedes and for each ejb server  configure different security policy.