If you're using the TurboActivate wizard then you can pass the proxy like this:
TurboActivate.exe --proxy="http://username:password@host:port/"
If you have a custom made activation screen then here's the article covering proxies.
Can you tell me if they need to have more than port 80 to your site open to them?
Port 80 is all you need open. TurboActivate uses plain old HTTP. We encrypt the data, of course, but it's still sent over HTTP on port 80.
Any suggestions on how to get them licensed without having the non-network based authentication enabled?
Well, setting the proxies should fix the problem. Also, unblocking your app (or the TurboActivate wizard) in whatever firewall software they use.
However if those aren't options, then there's always "offline activation".
Tell me if this helps.