A normal proxy (aka forward proxy) is an infrastructure service. I mean it's a service "somewhere underneath" your customer/business service. Just like internal DNS or monitoring or iLO/iDRAC.
How much separation is needed from the hostile world? Much vulnerability appears at the point where your systems listen. Manage that first, think about other reasons later.
Allowing a normal proxy to listen to requests from DMZ adds risk. Since the financial cost doesn't change much, I'd say place it deeper.
Deeper could mean in web application server segment, but it would be best to place it in separate infrastructural segment (depending on cost).
Having resolved the listener part, now the connector part. It follows you can "tunnel at the router level", which is probably better known as "route that traffic".