Media server and clients in the cloud

I am playing around with possible configurations of Netbackup 7.5 in our cloud environment. I am currently looking at a master server with a public ip while having a media server and clients behind a firewall in the cloud. opening the required ports from master to media should suffice as the media servers will be limited and a few public interfaces will have to be created, however doing the same for clients will mean an excessive amount of public network interfaces must be created and I want to avoid this situation. I thus need to determine if it is possible to not open ports to/from the client to/from the master server and maybe use the media server as a proxy?

This is purely for testing purposes and all suggestions are welcome.

Thank you