This is an IT Infrastructure issue. The server which hosts the ArcGIS Server 10.1 Instance needs HTTP access to the web adapter entry point as well. He's probably saying that changing the HOSTS file to redirect that web adapter request to the internal server is a security issue, which is partially true, but there's other ways to do it as well.
Getting a VPN involved naturally complicates these issues, but this is way out of the ArcGIS Viewer for Flex realm, and should be left to an IT Networking and/or Security Professional.