1) Rooting, if you use a root method that doesn't trip Knox, doesn't trip Knox. You have to read the thread about the method first. (Lollipop can be rooted on AT&T and Verizon Samsungs, but the last method I saw stated that it
does trip Knox (which is one reason I haven't updated). 4.4.2 is easy to root, 4.4.4 is more difficult, but only slightly so.)
2) You find stock Samsung ROMs at
SamMobile Firmwares.
3) If something goes wrong, just flash the stock ROM. Always have at least one ROM you can flash on a local computer (along with
Odin, which you'll use to flash it with). That way if your phone goes out when you have no internet access, you can still get your phone back. (The latest stock ROM available for your particular Note 4 [you didn't give us the model number] is probably 4.4.4.) If the bootloader is locked (AT&T and Verizon), there can't be a Cyanogen for it, because the ROM has to be signed, and anyone at Samsung who gave out the ROM signing information would be lucky to get life without parole. (I think in Korea they just shoot you.) Corporate espionage would be the least of the charges. All AT&T and Verizon Samsung ROMs are the stock ROM with modifications, since 4.3.
Make sure you have the current major version - if you're running 4.4.4 and you have 4.4.2 on your computer, that's fine, you can switch between them. But if you're running Lollipop you can't flash a 4 ROM any more. 5.0, 5.0.1, 5.0.2 and 5.1 are fine to go back and forth between (5.1 probably will be back-compatible to 5.0 - we'll see once it's out).