How to call RATINGS within FOO? Which address do I have to provide the http client in the FOO service to call RATINGS. Do I have to create a virtual service for RATINGS? RATINGS should not be accessible outside of kubernetes cluser.

You can still call other services the same way you would without istio. Since the service only needs to be accessible inside the cluster, you'll want to expose it with a clusterIP service. You can then call the service by name using Kubernetes DNS. In general, the service is available at http(s)://{namespace}.{service-name}. To call a service in the same namespace, you can leave the {namespace} out of the url.

While it is not necessary to create a VirtualService, it is advised by istio:

Although the default Istio behavior conveniently sends traffic from any source to all versions of a destination service without any rules being set, creating a VirtualService with a default route for every service, right from the start, is generally considered a best practice in Istio.

When FOO calls RATINGS, will the request go first through the own envoy proxy or it goes directly to RATINGS envoy proxy?

It will go through both envoy proxies. This is how istio can manage the routing of your requests and provide traffic insights like tracing.

The outbound envoy proxy can be bypassed though, with the traffic.sidecar.istio.io/includeOutboundIPRanges annotation.