For those kinds of situations, I've seen SaaS companies offer some kind of internal "connector", which could then establish an outgoing connection to a known domain, thus allowing the IT dept. to limit the access as they require.