Adding CAS to already MBX in Production

Hello All.........I am running an Exchange 2013 DAG of three-3 servers with two-2 servers holding active copies of the databases where as third server hosts only passive copies.  The servers with active copies have combined MBX+CAS roles and the server with passive copy has only MBX role.

Questions:

1.  Is this a good design?
2.  Should we add CAS to the third server?
3.  Can we do that without disrupting users?
4.  How can we do that? Steps?

Thanks in advance.