In terms of having support able to manage the systems, support will generally start a WebEx session to connect to the cluster.  So as long as you are stating that WebEx from a machine that is allowed access through a firewall we should be fine there.  In terms of the direct SSH access, as long as the cluster has a means to get out to the Internet via HTTPS then you can enable the direct SSH login option and that will work as well.  We tunnel the SSH session over HTTPS.
I have a requirement to lock down ssh/WebUI access to Isilon to specific ip subnets (going to use primus emc14002971).  My one concern is Isilon support access to my cluster using SupportIQ. Currently SupportIQ is enabled on our cluster to allow for ssh and web access, my goal is not to brake it by enabling restricted access. So the question is, what ip/mask do i need to add to my host.allow file to allow Isilon support to get into the cluster ?  OneFS 6.5.5.22  Thank you
Restricted SSH and SupportIQ