Hi,
As tboston says, it is possible. But also as Anders says you need VPN tunnels between checkmk server and agent environment.
We run that. We have the checkmk server in a cloud environment (only accessible with vpn client) and from there we have dedicated ipsec tunnels to our customer’s firewalls that allow the traffic between checkmk server and agents. We are right now testing with v 2.1 and so far it also works after opening up for port 8000 back to the checkmk server.
The other solution would be The distributed monitoring solutions as tboston also refers to.