Yes, it's possible. But you need 2 Connection Servers. One with enabled RSA that you connect from outside and one, without RSA that you connect from internal.
That's the way, we do it.
You can setup which Connection Server requires RSA Auth on the Connection Server Admin page.
Greetings