Yes...keep in mind that the communication for IAP and Airwave is ALWAYS initiated and sourced FROM the IAP. Because of this, Airwave doesn't need to know the remote network IP ranges/subnets and thoeretically, ALL IAPs can be behind a NAT'ed router. What you do need is 443 opened and Airwave reachable on the public internet if this is the deployment. If that is the case, you can enable IAP whitelisting so that only subnets you designate are able to log into the Airwave UI.