NTLM will still work, unless they are proxied. If you allow ONLY SSL,
then I would consider using Basic Auth and NTLM. IIS will use NTLM if
possible, and then default to Basic in this configuration.

Of course, there could be integrated authentication  issues with Basic,
but it should work.

Can you point me to some documentation on how to do this?

We have exactly that configuration. I have a FQDN web site that requires SSL and
it is configured for Basic and NTLM. Our internal portal has an alternate URL of
https://FQDN and it works fine.

Do you have some documentation on how to do this or can you point me
to where I can find it?

Assign a second IP address to the server network card, create a folder on the
server;e.g., c:\extranet, and create a new website in IIS and make the home
directory c:\extranet. Make the FQDN DNS point to the IP Address for the
extratnet web site. Set the site security to require SSL and set the port for
the site to 443 only - no port 80.

In SharePoint Central Administration -> Configure alternate portal site URLs for
intranet, extranet, and custom access. The default web site should vbe listed.
Edit the entry using the dropdown. Leave the default setting and put your
https://yourFQDN as the extranet.