If any host in the network sends packets to the Guest, the network will not know which host is responsible for that Guest.   Any/all packets in your network must be addressed to the hosts that your network operator recognizes.

I assume the Port features in the VMware NAT setup process will do what you want but, will forward any and ALL traffic sent to the host with that port number to the Guest.   The problem here, is that your host could be receiving 8443 traffic for many other valid reasons.  The host will not receive the packets truly intended for it.   People sometimes do things like this but, by convention, they will force the various endpoints to use non-standard (and agree-upon) port numbers. 

What you are trying to accomplish is a form of "tunneling" and for that, you are best off using Tunneling software (aka VPN software) on the hosts that are hiding the guests.  I'm not too familiar with Window's-based VPN solutions and don't know if that will work on hosts that have only one interface.

Regards

Ray