Would Force Tunnelling break WVD Front End?

I ran into the this requirement for a client that wanted to proxy internet traffic to an on-premise firewall. The provisioning process and the session hosts need to reach back to the WVD control plane constantly, and the control plane is locked down to Azure IP addresses. Therefore, since the fortigate firewall is on-premise, it won't work well. I was told that theoretically, you can deploy agents manually then use explicit proxy settings in IE setting to force traffic to go back thru the tunnel, but that is not an acceptable solution so we gave up. The support method is to proxy network traffic through an Azure-based firewall.