1) Dont let the users know the name for the traveler server that way they will be force to use the mdm server to relay traffic

2) Speak to the network folks to see if they can control that only ip traffic from the certain ip ranges can access the traveler server (mdm relay,  servers. admin folks) bu wireless device ip ranges can't (perhaps they fan force that traffic to route  thru mdm relay)

Thank you for the answer,

1) the users will see the traveler server name in the account settings on the device

2) that will not be that easy, the mdm is only here to manage the devices. Mailing etc will always go directly to/from the phone to/from the traveler server.

At the moment I use a reverse proxy server to access the traveler from outside. I may can deny some destination addresses but I have to test this first.

But however there should be a nice solution available