VRA in the DMZ

Are there any best practices for putting VRA’s in the DMZ?  I figure that there are three options in our environment:

1. Assign a public facing IP address to the VRA’s
2. Putting the VRA’s on the same VLAN as the vCenter server
3. Adding two NIC’s to each Host, and adding a Standard switch with the normal internal VLAN that the rest of the VRA’s use

Are there any other options I am not thinking about?