Tunneling traffic through the Access Point

In the JSON settings of the Access Points I have "tunnelenabled": true;

And on the associated Connection servers the Access Point config guide recommends not enabling tunneling.

The end result is that traffic is passing through the Access Point and not passing through the Connection Server. The customer wants to keep the absolute minimum for open ports between objects so I want to tunnel the traffic from the Access Points through the connection server and then on the internal virtual and physical machines that have the view agent installed. Even when I check the tunneling options on the connection server it still appears as though traffic is bypassing the connection broker and going straight to the agents.

What configuration change do I need to make to have all traffic pass through both the Access points and associated Connection Servers?

Thanks in advance for any assistance or suggestions -

J