Another point to add is if you do convince your security group to expose your CRM system via reverse proxy, you will need to make sure your basis team configures the "external url's" in the HTTPURLLOC table.
I guess in your case you are trying to avoid Citrix/VPN connections. Those generally work fine for internal employees. If you are trying to let other people outside of your company access CRM then it's another story(which it looks like it here).
Honestly I would recommend setting up another SAP Netweaver Application Server in your DMZ/webserver and only allow external access to that machine and let it only communicate to CRM via trusted ports/rfc.
Take care,
Stephen