Cloud Enabled Management, DMZ and Patch Management

I'm having a hard time getting a straight answer from Symantec Support so I wanted to see if anyone here has setup SMP Patch Management in their internal network and is patching clients in a DMZ?  And if so, what method did you choose to set this up?

I am on 7.5 and was told that I would need to configure Cloud Enabled Management, but I am unsure of what type of servers I will need in the DMZ to host this and if I need a Site Server in the DMZ also.  And I'm having troubles wrapping my head around what servers and how they will communicate with my NS internally and how the clients in the DMZ will get the patch information and data.