This thread is probably too dead to resurrect, but I am in the exact same boat, and have hit the same roadblock with Support. Basically, for the life of me I cannot get WBEMTest to connect to any remote device.
In opening a ticket with support, I was informed that BEM is supposed to act as a broker to One, so by adding BEM to one, nothing further should be needed for One to enumerate the components. However when adding BEM to One, it can see the existence of components, but is unable to communicate with any of them. I ended up as a test trying to directly add machines to One, and it has yet to succeed unless we open a BOVPN tunnel, which isn't an option at scale.
I am also getting the exact same error mentioned above when attempting to connect via wmi / wbemtest of: "The object exporter specified was not found"
I went through the documents referenced, applied all workarounds, and while WBEMTest works fine on the client's LAN, it can never reach into the LAN from the WAN. Interestingly, if I give WBEMTest deliberately incorrect credentials, I immediately get an access denied message, so it is getting far enough to authenticate before it fails. As this point, Veeam support seems to suspect the issue is a protocol level failure on Msft's end with WMI, but seeing this exact same set of symptoms leads me to believe it is an issue with Veeam.
Bigger picture here, I feel like I am missing some obvious easier way to make this connection. Having to make a huge set of port rules and local permission changes per device doesn't seems scalable. Is there no way to drop some agent in place on all servers that have Veeam, and have that agent know how to "phone home" to a One instance? Or more to the point, is this just a case where One is not designed to administer anything larger than a single LAN? If so, is there an equivalent to ONE designed for MSP's?
Automate all the things!