Put the Guac instance in a public subnet with appropriate security group rules. Put the target instances in private subnets. Add a NAT in the public subnet so

Put the Guac instance in a public subnet with appropriate security group rules. Put the target instances in private subnets. Add a NAT in the public subnet so that the target instances can get security updates and install new software. It's not perfect but it works.