For a production environment and where the call flow is high; You should use a CUBE with "flow through" configuration.
If you just want to test whether there is any way to make it work, make a SIP Trunk (to CUCM on public IP) and check MTP required. Put only software MTP in the MRGL that is assigned to the SIP Trunk, this will force all media to go through CUCM servers.
But your Network should still be able to NAT udp packets , otherwise how the packets will be routed ?
Not Tested, so correct me if I am wrong :).