Securing Kibana and ElasticSearch without X-Pack-Security plugin

A customer integrated the ELK stack into their application. If they run their own ES cluster, or use the managed service provided by elastic.co, they can lock down access to Kibana and ES using the X-Pack-Security plugin.

They're aware of the approach outlined in https://aws.amazon.com/blogs/security/how-to-control-access-to-your-amazon-elasticsearch-service-domain/, but want to avoid the need to run a proxy to handle authentication between Kibana & ES.

Do we have any alternative suggestion?