You can use the UAG to reverse proxy both the vIDM and Horizon. It is recommended to use separate UAG for the vIDM reverse proxy and the connection server reverse proxy. One thing to note is that the UAG doesn't provide load balancing. That is what the F5 LTM is for.
I would use the F5 for doing the reverse proxy for the vIDM instead of a UAG. It doesn't provide much value using the UAG for the vIDM like when using the UAG for the connection servers. F5 is a reverse proxy when you apply an HTTP profile to the virtual server.
So my recommended solution:
F5 LTM -> vIDM -> F5 LTM (LB UAGs) -> UAG -> F5 LTM(LB Connection Servers) -> Connection Servers -> RDS Farm/Pool
In this case, you can scale out the vIDM, UAG, and Connection Servers horizontally if your environment grows.
If you want to not use the F5 at all, this is an updated version of your desired: You can use DNS RR if you want some type of load distribution.
external user -> UAG(vIDM) -> vIDM -> UAG -> Connection Server -> RDS farm/VDI pool
Note that you actually don't tunnel traffic through the vIDM. It simply redirects you to the UAG or Connection server for the application. You want the UAG as an edge entry point.
For 2FA, you can use vIDM for that or setup radius on the UAG. I recommend the vIDM as it works much better.
For using the vIDM with 2FA, you create a 3rd party IDP on the vIDM server. You will want to force the UAG/Connection servers to use vIDM. You will also need to setup TrueSSO if you want a seamless login.
