MS Certificate Web Enrollment authentication between domains

I'm trying to set up the Certificate Enrollment Web Services to give autoenrollment to some clients. The issue is the clients are on a separate domain to the CA. I see the CES/CEP allows three options for auth (Windows, cert, useame/password), but realistically only Windows integrated is secure enough for autoenroll for every user.

Is there a way the CEP/CES can use Windows authentication for clients coming from another domain WITHOUT having a two-way trust? I'm not super experienced with these Microsoft services.

Thanks!