I was told by support that remote workforce only works with internal authentication. Using LDAPs would allow us to manage our remote workforce accounts on the client domains and remove access automatically when the account is disabled.