Could someone give me a sanity check on this advice I just gave to a colleague/friend?

They have a fibre optic connection from a local ISP, going into a media converter with a Unifi UDM-Pro. It is then connected to an antenna then send a signal ~2km to the other Antenna which then connects to the WAN port of the router doing PPOE authentication.

Equipment setup is ubiquiti Rocket Prism 5ac Gen2, wireless connected to a PowerBeam Gen 2 > connected to a WAN port of Unifi UDM-Pro. He needs access to the private IP's "on the WAN side" .

First off I've never dealt with Ubiquiti equipment, or a setup like this.

My initial suggestion since he asked me about NAT was using NAT overload, but then as I read more carefully and saw I may have had this setup backwards, other thoughts of mine would be a VPN to access the private network or static route on the destination router.

The antennas need to communicate with Ubiquiti Servers for UNMS to function and he says he needs management access locally as well.

Crude topology diagram I was provided https://photos.app.goo.gl/pMu4itgoXmeUSnyt8