Based on the tutorials I've reviewed so far, it looks like we have 2 options for setting up page access:
> ALL pages combined into one public site.
> One public welcome page with all other pages set for private access.

Is this correct? Or, is there any way we can configure a site to have a mix of multiple public and private pages?

If not, could a similar result be achieved by setting up a main public site with a private sub-site?

Pages can be given their own view permissions regardless of the Single Public Zone, which effectively just makes everything in the 'site' zone act like it exists in the 'welcome' zone (which consists of more than just the welcome page). You can create additional pages in the welcome zone and perhaps even output some 'site' content there using Comcode blocks (which have their own options regarding view permissons in most cases). The same applies to the site zone, or any other custom zone.

By default, modules and pages within the 'site' zone will be run from that zone and viewable by members only (but this can be overridden, like most things in Composr, and the 'site' zone can be set to allow Guests). Redirects and/or the Permissions Tree Editor may be useful depending on what you plan to do, though most (if not all) content has permissions which can be set, either overall or on an individual basis and you can still be selective about what Guests can access one way or another. A little bit of Tempcode can work wonders if you opt for Single Public Zone (and even if you don't) if you are willing to put the time and effort into editing custom templates. There is also support for custom zones, and even MSN's if you want to go that route.

Basically, whatever you are planning to do, the answer is very likely yes it can be done. The default setup with the welcome and site zones is the easiest method of keeping guest and member content/features apart without additional effort, but I've used both setups and there's not a great deal of difference overall. It's a simple question of whether you want/need a 'site' zone or not. If not, prepare to spend a little more time and effort to achieve your end goal.
 

In simple terms…

You can control who can access a zone.
You can control who can access a page.

To access a page you need access to both that page and the zone it is in.

Most users will control it on a zone-level as it is then simpler to think about who can access what.

@Adam & @Chris ~

Thank you both for your helpful feedback! Very much appreciated.