Use a database login from your OffloadSQL dashboard.
Connections go through your instance's router with TLS, just like your apps.