FYI - just in case anyone else wants or needs to know if this works, and proven that it does...
NetBackup Master Server v8.1.1 on Windows Server 2016
NetBackup Media Server v3.1.1 on Appliance 5340 - MSDP storage
hosting hypervisor: Windows Hyper-V Server 2016 Cluster
client: NetBackup Client v8.1.1 on Windows Server 2016
client networking: client residing within an NVGRE bubble
backup: full client backup via Windows based agent within guest VM, with BMR and TIR enabled
restore / recovery: whole VM via BMR, across NVGRE - this worked just like a normal non-NAT'd VM, and certification with a re-issue token worked, with the end result of a guest VM fully rejoined to its original AD domain within the NVGRE bubble.
FYI - just to be clear this was not a test of VSS based (Windows Hyper-V 2012 R2 or higher), nor a test of WMI+RCT based (Windows Hyper-V 2016 or higher), hypervisor based "VM style" recovery - this was a test of a traditional BMR client recovery across an NVGRE threshold, and it worked just fine.