Usb over ip for digital signature from external network. Is it possible?

Question

USB

Hello! There was a task: to encrypt the PC of a number of users with a bitlocker, and to log in through a token. At the same time, tokens must be stored in one place (there are not many of them). In some situations, disable the hub, access is closed. In this case, the hub must be offline.
Questions:
1) Can bitlocker accept a token that is inserted not directly, but through a remote hub like anywhere usb for unlocking?
2) Can such concentrators themselves work from outside, without vpn, subject to forwarded ports and the rest due.
3) I haven’t done any work experience and tests yet, so it’s interesting: if you pull out the token, does the PC immediately block access or does it need to be forcibly blocked by START + L or reboot / shutdown?