VPN or SSH (reverse) tunneling. This looks a lot like IBM making things so complex that you need to hire their consultants.
That's what they are doing.
They are just doing it within the 5250 emulator instead of setting up a separate tunnel with a VPN or SSH port forwarding scenario.
You are a brokerage and your Setup with IBM is a mature system that would cost you lots of capital to overhaul to SSH. Your already have a plan to do this and it will take 1 or 2 years to roll out and justify the cost to the board of directors. This answers the question : What do I do now to secure this system.