Does Usage Meter go in the DMZ or behind firewall?

I'm trying to determine if its more simple to put the UM VM in the DMZ and allow access to vSphere through the Firewall from the UM or to put the UM VM behind the firewall and allow the access ports open to it, 443, 8443 etc?

I couldn't find any kind of network diagram or best practices.

Thanks.