PI Connector for Wonderware and using PI to PI Connector

I noticed that the PI Connector for Wonderware needs access to the AF. If your AF is on the Business Network and your SCADA Wonderware is just talking to the PI Archive in the DMZ, What is the best approach to getting this to work securely?

 

Do you need to spin up an AF in the DMZ and then sync with the Business Network? When the Business Network creates new AF Analytics/tags in the PI Data Archive does it just stay on the Business side?

 

If I can't figure this out, my simple less secure method would just to put everything on the Business Side and then have pin holes from my SCADA side WW Historian to the Business Network PI System.