I'm reposting this to encourage responses. There was a lot of noise on this thread initially; please be noisy now. If you have concerns about firewalls and the AG, talk to your network admins so we can address them. Specifically (reposting from original):

What are the concerns of your admins? Do they care at all about opening up the multicast address range? Why? Would it be enough to be able to select a bridge with a known port range that would work for any venue?

I think the real problem is in bridging, where you're concerned with traffic from real hosts. But let's get input from some of those (Draconian) net admins and build a practical solution.