It's not. It's supposed to use a publicly routable address. Private addresses were an unfortunate hack that got massively overused when people would've been much better off putting the same effort into using IPv6.
Down this path lies the IoT security apocalypse. Imagine every cheap, unupgradable IoT lightbulb with a publically routable IP address. If IPv6 was widely adopted tomorrow, I'd still run my home LAN services behind a NAT.
Addressability != access. By all means firewall your devices (though I'd strongly recommend something more granular than a perimeter firewall - particularly in the days of insecure IoT devices, an attack could easily be coming from inside the network), but they can still have proper addresses.
Delegate address space the whole way through your internal network - you should get a large enough block from your upstream ISP that this is fine. If you're too big for a single upstream ISP you should have your own AS number and participate in internet routing.
If this is truly disconnected from the Internet then yeah HTTPS is unsuitable - it fundamentally relies on the idea that there's a central, universal definition for who owns "foo.com" so that users can rely on talking to the correct "foo.com".
