Trying to understand how I can utilize OAG to allow users not on our network access to an internal web app.

I understand how it can be utilized if the internal app is utilizing header based or Kerberos authentication but not sure how it would be implemented for my specific use case.

Here is the situation.

There is an internal web app that is not exposed to the internet, only users within the network or VPN can access it. This app is going to be moving over to utilizing Okta for authenticating to the app either via SAML or OIDC very soon. Once that happens then the next challenge is to find out how to allow external users that are not on our VPN or network access to the app. These users do have accounts within our Okta tenant but will not be on our network or VPN when attempting to access the app.

So the question is how can OAG be leveraged to allow access to an internal application that is utilizing SAML or OIDC, for users that are not on our network?

I did find this documentation for a SAML-Passthrough application but wasn't sure if that is exactly what I am looking for. Any help would be greatly appreciated!

https://help.okta.com/oag/en-us/Content/Topics/Access-Gateway/add-app-saml-pass-thru.htm