You do the standard thing: VPN into the datacenter's management network for IPMI-provided [0] KVMs for the isolated hosts, then connect to one or more of those KVMs.

If the software under test can attack the IPMI to gain access to the management network it's connected to, and then hop out to the Internet through either the VPN server or the IPMI client software, and the problem wasn't caused by a boneheaded misconfiguration, then that's a very interesting finding that everyone will want to hear... because that's a vulnerability in a component that's expected to safely run alongside hostile workloads.

[0] I'm using the name "IPMI", but the thing goes by many other names: BMC, LOM, iDRAC, iLO, etc, etc, etc. Whatever you call it, it's a little computer built into the motherboard to provide remote access and management to the system it's built into.