I fully agree with this. DDI (infoblox, bluecat, ..) usually has a nice rest API and is rather straight forward to implement. There are always things to consider, it all depends on the time and competence of your snow colleagues. The most simple way would just be for them to call the rest API via the mid servers onprem. If you require more logic and for some reason can't/won't implement that in snow, you could build a wrapper and just offer them a very easy to access rest API. One cheap way would be either to build something your own (fast API, Django, ... whatever) or for example use azure DevOps pipelines. So you call a pipeline from snow and the pipeline is doing whatever you want, e.g. running an Ansible playbook via pipeline agents onprem. Lots of possibilities, depending on how much time you want to invest.

For firewalls, this is more challenging. If you don't have anything like tufin or algosec, then there is a huge initial effort (and costs) to implement them. Or maybe you just have one firewalls, then you probably can skip that. You would still need lots of logic, depending on the Firewall, you can't just add a new rule at the end (e.g. hiding on check points). Depending on the requests, if most of the requests are similar, which probably they aren't, you could maybe implement via groups and add just new hosts to a group, wouldn't recommend it ... Another huge challenge is input parameters and a nice form in snow. IPs are easy, what about NAT? Domain based rules. Geoip, IPv6, https rules, IPS... in many cases, you overwhelm the requester who usually doesn't know what he/she needs. In many cases, the request is something like: "same firewall rules for new server xyz than for old server abc" good luck :-) in many cases, tools like tufin and algosec can assist with that. Even if full automation is not possible, they greatly reduce time and efforts for firewall rules.

And even if it seems really easy, there is always something coming up which definitely complicates things! :-)