A self-signed SSL cert could work for it. There may also exist other solutions that we are not aware of. 99% of the target users will resolve it if they want a

A self-signed SSL cert could work for it. There may also exist other solutions that we are not aware of. 99% of the target users will resolve it if they want access (by installing the necessary browser extension). As for system emails, etc., they can come through any regular domain.