If you don't deploy a FE, then you can't abstract the BE server where they
get their mail.  What ends up happening is that if you setup a record to
resolve your BE server from smpt1.domain.com, then a user would contact that
BE server, login, and be redirected to
https://servername/exchange/user/inbox (or similar).

Because your firewall rules likely wouldn't allow that, nor would name
resolution likely work (unless you publish your internal DNS FQDNs for you
internal Exchange server names) so the communications would break.

You can verify this by doing this on your internal network.  Connect to
http://yourexchange_FQDN/Exchange where yourexchange_FQDN is your server in
RG A.  Login with a user-object that has a mailbox in RG B.  Note what
happens (you'll get redirected and your Exchange server FQDN in the URL bar
will change to the FQDN of the server in RG B.)

Best bet is to deploy at least one FE server and ISA to publish it.  You
could (and likely should) put the FE server in the trusted network and put
ISA on the DMZ or otherwise on the internet with TCP 443 traffic permitted
from it to your FE server and back.

Does that help?