FortiMail IBE in TP mode

[Fullmoon]

Anytime soon if there is no glitch I will implement FortiMail in TP mode with IBE functionality.

Since FortiMail will have a management IP only, do I need to do DNAT so that external IBE user/s can access FML IP address when clicking the email with IBE link for registration?

Here's the topology.

Firewall--->SEG--->FML in TP Mode--->Exchange Server

Any insight is much appreciated.

Regards

Fullmoon