It depends on your setup.
At the one armed concentrator you still need an upstream router/firewall for internet or WAN connectivity.
If the servers you need to reach are in the same subnet as the MX concentrator then the MX can directly reach those devices although it is not best practice. It is better that the one armed concentrator lives in it's own mini subnet and the upstream router/switch/firewall routes towards the server.
At the spoke you can have that MX be the router of all the local subnets there.
If you want more depth information it would be great if you added some more details about your setup though.