Management routes accessible from TMM? Are we crossing the streams?

well if security is your concern i would recommend creating route domain and placing the HSL server pool there. I believe this will isolate this traffic and should provide some protection in the sense of routing. you would need specific data-plane interfaces to be assigned into the route domain to isolate it from the other traffic.