As to the "gap", it would be good to understand their specific concern(s).  Then we can address those.  Keeping in mind that if they want anyone to log in via the public internet, as opposed to their company intranet or VPN, they will have some form of authentication exposed to the internet.  

Another idea might be to collaborate with the ServiceNow Sales consultant assigned to that client.  He/She may be able to pull additional information from the field security team to help this client or join you in meeting with the client to discuss options.