The only way around this for now would be to include the Public Location IPs so that they can access your internal application. You can find these IPs when you go create a web check or edit an existing one.
However, I do believe that private agents (similar to Synthetic) are in the pipeline which should take care of your use case.
You are correct, webchecks are not currently available to private URLs. This (HTTP monitors) are actually currently being worked on and is planned to go EAP around end of January/February, and public beta in March.
Hope this helps,