If you need to allow some of your AD users to access from outside (e.g. Public network) so you want to use a different access for them through a new virtual proxy.
This new proxy need to use a custom authentication solution (http://help.qlik.com/en-US/sense/3.2/Subsystems/PlanningQlikSenseDeployments/Content/Server/Server-S...)
If you want to allow just some AD group to use an external access you can do that in diffeent way using the Security Rule (eg. in the Virtual Proxy configuration you can Extend Security environment and track the source IP on what of which build the Security Rule or using the coming Virtual Proxy for that).
If the access come from the Public Network you can also consider to put a new proxy in DMZ.
OR
You need a full qlik sense server. You can place it on the Internet with SSL certificate and all customers can take full advantage of self service BI.
But here it is necessary to count the number of licenses (tokens).
You can add the hub URL to the whitelist in QMC. Otherwise it'll throw error.
