iExpense causes hole in firewall, any suggestions on how to fix it?

We had iExpense implemented by consultants in EBS 12.2.3 a few years ago. In order to make it work from mobile phones, we poked a hole in our firewall using the main URL (server.domain:8000) so people could enter expenses from the iphones while traveling. However, during security scans it has been noted that it exposes the entire EBS system to the outside of the firewall, and there's no MFA enabled/required for EBS.

1. Is there a way to expose just iexpense outside firewall without exposing the entire EBS system? Like, a more limited URL where they cannot then login to the entire financials system from outside the firewall?