The SNC in the SAP Router product will only work with another SAP Router (not SAP GUI). So, if you have SAP Router in your DMZ, and you must use this, then you must have SAP Router somewhere else. I doubt you would want to put SAP Router on a users workstation :-)
Unless I misunderstand your situation, I think you have to use a VPN unless you open a 'hole' in your firewall for the SAP GUI ports (32xx etc.) and put appropriate firewall rules in place for the IP port / NAT etc. and see if your network security team allow that.
Thanks
Tim