How should I set up SQL Server Login permissions for access to website on a different server using Windows Authentication
In order to get the application pool account to be recognized by the SQL Server you'll have to configure the application pool to run under a domain account.  Then give this account the rights that it needs within the SQL Server instance.

If you are using Windows auth then your users will need read access to the folder which is hosting the website, otherwise they won't be able to read the files for the website.  This is normal. Just give the users of the website read only rights to the folder which hosts the website.