This config should work if port 443 is forwarded to 52311 or somehow the relay is set to use 443 or if the connection is proxied from 443 at the configured URL to 52311 on the actual relay. It seems like this would only work if enhanced security is off.
I keep meaning to try a failover relay configured to port 443 but I haven’t done so myself.
Just to be clear, you don’t need port 52311 open on the clients, only that the relay be able to accept incoming connections over 52311 over the DMZ.