The instances establish an outbound connection to the API SSM API, so as long as they can hit that, Session Manager will work.

Connectivity from a private subnet to the AWS API could be (a) NAT gateway (b) HTTP proxy (c) PrivateLink VPC endpoint.