.Net clickonce application and Apptunnel

Yes, it should work OK. Two requirements:

1- You must use a hostname and valid certificate to access the APM virtual.

2- The client must have the DNS Relay Proxy installed so that it can resolve the hostname properly and proxy the connection to APM. It's an optional components of the Edge Client installer.

Note that ClickOnce applications are NOT compatible with APM's Web Application reverse proxy (Portal Access) due to strict signature requirements on the manifest file provided by the application.