It might be overkill, but you can set up a reverse proxy server using Application Request Routing and URLRewrite (modules for IIS available from the Gallery) or Web Application Proxy role in Server 2012 R2. Basically, it acts as a “firewall” between SquaredUp and your users. Depending on your network design, you may need a dedicated SquaredUp server, depending on if you want all SquaredUp traffic to go through the proxy or only Open Access users.
What you do is have the reverse proxy site require authentication and you set up the ACL and back-end URLs. It will then forward only allowed traffic to the SquaredUp server. You have to set the SquaredUp server to only allow web traffic from the reverse proxy, so users can’t just go around the web proxy.
From the user perspective, it’s a logon to get to the Open Access dashboards and it otherwise operates the same as if access were unrestricted.