Dynamic seed provisioning , or CTKIP, does not require a web tier.
If the device can access port 7004 on the primary RSA Authentication Manager, then it can CTKIP a token.
A web tier (and this is when you would need to configure a Virtual Host) is essentially an RSA Authentication Manager self-service portal that can sit on the DMZ (essentially a proxy server) and allow internet access to do CTKIP without being on your inside network.The web tier then has it's own private connection to your internal RSA Authentication Manager primary on a separate TCP port (7022).
The 127.0.0.1 URL is correct if the device that is doing CTKIP understands the URL format (there have been some changes over time on some URL formats). So, the best thing do do is: refer to the Software Token admin guide for [device type] and see what the URL format should be, and then you can configure a software token profile and create the appropriate CTKIP link for an end user to click. The 127.0.0.1 instructs the device to pass this string to itself where an internal app is listening (which is the RSA software token app) and then the app does it's own real network connection to perform the token download.
On this page
https://community.rsa.com/docs/DOC-40601#token
you can find the documentation for [device] and it will show 'token delivery methods' and any special URL formatting required to do CTKIP with that device.
CTF (compressed token format) is another option for some devices, where you get a very large 'URL like string' in which the entire token is encoded, and requires zero network connectivity.
Example: com.rsa.securid://ctf?ctfData=200002073572073562316564702224415011025055165634316176564172163270773376671627232
