Is your concern related to clients reaching out directly to the BES Root server or related to other services(APIs, web reports ?).
If this is about clients, why don’t you force your agents to only use the relay?
You could edit your masthead and add the last fallback relay setting to it, and then have your bes root server behind that balancer in a hidden mode that only the relay can talk to it.
All your clients could come through the relay and you can update the name of the relay as your installation/license is not tied to it.
This post could give you some ideas.