If FileMaker doesn't allow longer timeout limits, say four hours or more, our powers that be are likely to direct that we go with a different system.
I doubt it.
I can't see any security conscious decsion makers mandating that you'd go with an system that allows for longer time-outs. If that is the kind of peope that you are up against, be glad to step away. You do not want to be in the middle of a security audit this way.
Yes. This server, however, is only available on our LAN and VPN.
That does not really matter. Most security policies will not want to have a browser session extend for hours...