SEPM in a DMZ

I'm looking for Symantec's take on placing a SEPM in a DMZ in order to manage remote clients. This will be for roughly ~200 SEP clients which come and go from the corporate network. When they go off the network, I want them to move over to the SEPM in the DMZ so that we still have visibility of them and can manage accordingly.

We are on 12.1.4a and this is a new requirement so I want to get this right. I'm just looking for what port(s) are needed and other recommendations provided by Symantec.