We had a similar problem a while back, when we wanted to create downtimes/acknowledgements via the API from clients that can only reach the satellite in their zone but not the master.
The satellite will accept the API request and will forward to the master, but the master will not accept the update because it has the authority over the satellite zones and therefore does not accept config updates from child zones.
What we ended up with is a simple HAproxy on the satellite, listening on port 5666 and forwarding incoming requests to the master.
See here
This could be a solution for your problem as well, if I understood it correctly.