Hey, so your retention for the VM will depend on which type of backup chain you use, reverse or forward incremental. Any solution can give you the “at least” 2 restore points, there are a few considerations around storage performance but I won’t dilute my reply here going on a tangent. For your reading here’s a link to backup methods. It’s for vSphere but it’ll work the same for Hyper-V as it’s nothing to do with the hypervisor.
I would recommend using a modern file system such as ReFS or XFS to make use of Veeam’s Fast Clone technology if you decide to use synthetic fulls (create a new chain weekly as a full independent backup but using your existing backups as a source to fetch existing data from) or active fulls (create a new chain based on reading all data from your production again). ReFS is for Windows and XFS is Linux, further reading on Fast Clone here and the requirements for each system.
As for your file server that’ll depend on whether the file server is an actual server or a NAS (assuming a server) and whether it’s a VM or not (as you’ve mentioned it independently I’m assuming not). If it’s physical you’ll need to use Veeam Agent, if it’s in the cloud you should use the relevant Veeam for <public cloud here> product, if it’s a VM or NAS then use Veeam Backup & Replication (you could also manage the Veeam Agent job from this product anyway for single pane of glass management). Providing your production and backup infrastructure are both fast enough this is easily achievable.
Final consideration I’d like to mention is that you should look to achieve the 3-2-1-1-0 best practice rule in your backups, I won’t reiterate it all here as here’s an awesome blog post by a Veeam employee. Crucially though if you need to retain data for 36 months, then it’s likely you’ll be in a lot of trouble if this falls short. Which is why it’s important to consider the multiple copies of data, off site requirements and ransomware resistance. Do give the article a read, it’ll give you a lot more considerations to make sure you address any assumptions that are being made about your data protection scope that may or may not be true.
Good luck!