It's nice to see someone caring about safety for once. Batteries can be dangerous things.
Built in protection in the cells is usually very limited, often just an unreliable thermal fuse. A best it gives very little protection, but I find it gives a completely incorrect sense of safety. If a cell has built in protection, my response is to say that's nice, and then treat it the same as if it didn't have any.
A BMS is good idea. But BMS can be at any level. Theoretically they should:
- Stop over charging (safety)
- Stop over discharging (safety)
- Control charging (from a practical point of view)
- Protect against over (and under) temperature events (safety)
- Balance all the cells in the pack (for safety, cell life and performance)
- Monitor pack usage for general information and for state of charge
But I am aware of may commercially available ones which do not do all these things. I have tried to put these features in commercial packs I was working on, but was told it was too expensive, and not required as we had already covered the bare minimum.
Fuses should always be fitted. But they are the final level of protection. Make sure you fit the correct one for your system, but make sure you design the rest of the system (including the BMS) so that you never need it. A fuse is for when other things go wrong. Fuses will not save the pack in case of over or reverse charging. Thermal fuses are a nice idea, but are not to be trusted any more than normal fuses. I would fit a thermal fuse as well as a standard fuse.
All decent BMSs will monitor cell temperature. It is required of pretty much all safety regulations CE, UL etc.
Li-Po safe bags is a nice idea, but again it's a thing that should help if things go wrong, but you should have a BMS which stops this ever being required.
A fuse per cell shouldn't be required as the mechanics of pack should not allow access to individual cells.
You appear to have missed off the important box for the pack. The pack should be in a nice self contained insulating box so that there is a physicals barrier between the cells and the world. The power comes out via a couple of contacts (and maybe some method of talking to the BMS if required, but that could be only one more contact).
In summary: put in everything you can. But make sure the cell pack has some physicals protection between it and the outside world. This stops it hurting the outside world, and the outside world hurting it.
A decent BMS, which does everything I listed above, would be a good place to start. There is no such things as too much protection.