App registration for API and Client questions

I am creating a web client and a web API. As I understand, I should have one app registration for each.

1. API app registration - do I need to include Graph API user.read?
2. What happens if I add another Graph API like user.read.all? Will I need new consent for client application?
3. If I add a new scope to API app registration that is not added to the clients role, will this trigger new consent for client?

Best regards

Roger