Has this ever worked...even internally? Are most of your iPads external to your organization's main production network?
If yes, I am betting that you are not letting traffic on port 8443 through your firewall to the server. There are numerous ways to that including an excellent document by jamf about ports that need to be open (https://jamfnation.jamfsoftware.com/article.html?id=34) and another about setting up a limited access JSS in the DMZ. (https://jamfnation.jamfsoftware.com/article.html?id=174)
You also need to make sure that traffic outbound and inbound to Apple isn't blocked. They cover what specifically needs to be allowed in Jamf's document. The sad thing is that Apple won't drill down on what servers need to be available and advise networks admins to open traffic to all 17.x.x.x (which Apple controls).
