Cold storage for an exchange wallet should be where you start. Then have some small amount that is not cold.  

And bitcond on the web server?  That is a bad idea.

The fact that you are asking these questions is quite concerning for anyone who would want to use this exchange.  My suggestion is to do a lot more reading to see how exchanges have been hacked, what others have tried and recommend and then think about the architecture you want to use based on that.