By placing a reverse proxy between OpenAM and the Internet, you expose only the necessary endpoints outside your infrastructure. Notice that OpenAM installed with the console is inside your infrastructure as well.