In short don't do it....NetSUS is a support service for your Macs. If the machine has issues or if NetSUS has issues, both services are down. If you do it anyway in spite of that, make sure when you declare Tomcat Memory and SQL resources that you are measuring your load right and that enough resources are available to run all the services needed for the JSS. I don't know what your iOS/Mac client load is so I can't offer proper advice beyond keeping it separate for all but the smallest of deployments. We have 6000 iOS/600 Macs here and I actually have a cluster built for the JSS by itself, let alone separate services such as NetBoot and Software Update.
Assuming you have given your JSS adequate resources for even peak times and have plenty of server resources to spare, visit this website and run the installer, not the OVA file: https://github.com/jamf/NetSUS/blob/master/docs/getting_started.md
In general I believe if you run the NetSUS installer, it will rely on regular Apache and not Tomcat. the JSS relies on Tomcat running on 8443. NetSUS does not use port 8443, it uses 443 and port 80 (along with a few others).
To make putting it on a separate server easier, consider using the NetSUS .ova file on the separate server. Everything's all built and ready to go, it just needs set up and tuned.
One "gotcha" I can think of if you combine the servers is make sure that both NetSUS and Tomcat have a trusted cert loaded into them. Apache uses openssl and Tomcat typically uses keytool.
