Delegate address space the whole way through your internal network - you should get a large enough block from your upstream ISP that this is fine. If you're too big for a single upstream ISP you should have your own AS number and participate in internet routing.

If this is truly disconnected from the Internet then yeah HTTPS is unsuitable - it fundamentally relies on the idea that there's a central, universal definition for who owns "foo.com" so that users can rely on talking to the correct "foo.com".