Self Service Portal in VCAC 6, and alternative methods to exposing user access to vCAC without multiple "holes" in firewall

I am setting up VCAC 6 for the first time, and have noticed no install guide for the self service portal.  Did this feature drop off?

I am also noticing that enabling "external" user access to the system requires "holes" for both the vCAC landing page AND the identity server in the firewall, is there a way around exposing so many points of contact?