I recommend the following:

1 app  Pool for Central Admin

1 App Pool for SSP

1 App Pool for all other Web Apps (portals)

If you wish to further increase process isolation, you can create
additional application pools  (with associated identity) for each Web
app. This isn't required or necessarily recommended - only when security
is an issue. Every Web app you add in MOSS07 requires 150-200MB RAM, so
for performance, fewer app pools are better.

We could argue this round or flat, but I am not sure how much security
multiple App pools buys you, seeing as they must all be local
administrators on every server in the farm anyway. Oh yeah, multiple
app pools can buy you some isolation between Web apps, in case you have
a Web app go nose-up.

Of course, adding multiple threads to the app  pool can get you some way round a
badly behaving web  app with a regular schedule to recycle the app pool and
warmup scripts for the web apps

Certainly your central admin should be on its own app pool

I am not sure that I would bother with separate app pools  for ssp and content if
they are on the same server - as Ben says, your security is all shot in that
instance in any event - if they are on separate servers then, yes, I would
consider using separate app pool accounts though a lot of people suggest using
one account as it removes any problems with different parts of the solutgion
being able to commmmunicate with each other

I thought that the number of web apps is more down to your design rather than
performance although with moss  fewer web apps each with more site collections is
supposedly far better for performance than more web apps each with fewer site
collections (if that makes sense) but I couldn't tell you why

Also, the standard sizing advice is:

No more than 10 web apps per app pool

No more than 20 web apps on one server without starting to load balance (I.e
more than this and you probably have a medium farm on your hands)

Use multiple threads per app pool as stsadm will always reserve a thread for
itself

Just my thoughts but I am sure others will also have a slightly different take
on this.

I always prefer to
keep things as simple as possible, and it appears that I can keep it that
way.

We have Security concerns that has led us to choose the following

1 app  pool for CA

1 App Pool for a public SSP

1 App Pool for internal / private SSP

1 App Pool for all public portals

1 App Pool for all private portals that use the private SSP

1 app Pool to isolate mysites.

This might be a little overkill and the permutations of service accounts
are dizzying, but we want to make sure we don't inadvertently expose
private content to our public patrons through searches.