Access Mattermost via internet w/ Gitlab auth and w/o publishing gitlab itself

Right now we use authentication via Gitlab-OAuth-Api which then authenticates against our LDAP. Works perfect.

We now want to be able to use Mattermost from outside the coporate network without "publishing" our Gitlab services.
Also we don't want to have seperate user accounts for gitlab and mattermost. Did anyone manage this or could give me some advises/thought about that?

We are currently using the Omnibus-Gitlab package "gitlab-ce-8.15.3-ce" on CentOS 7. Mattermost is running version 3.5.1. Both on the same server.

Thanks,

Denny