I don't want to have to pick port numbers for the usual JMX remote management property. Is there a standard methodology for setting up some sort of proxy (e.g., via ssh) to avoid the need to to do this?
When your application server does not have such a http based way to access JMX, you could create it on your own. Perhaps you can use this nagios plugin (Jmx4perl) as a starting point. It uses a small java web application, which has to be deployed. After that you cann access the JMX server with http. It also has a special proxy mode, with a dedicated proxy server.