That's really an architectural question, and we have too little information about your circumstances to give a definitive answer.
Embedding it in Tomcat should make for better performance (no network traffic between the application and the DB), but it also means that the DB will go down whenever Tomcat goes down. If the DB is only ever accessed from the Tomcat then that may not matter, but DBs have a tendency to develop other -standalone- clients for special purposes.
Note that you can run Derby on the same server as the Tomcat, but still as a standalone server. That way it's independent from the Tomcat, but you don't need a separate machine.