I think this worked for me in the past - but as long as you have access to ports 48484 (supervisor) and 2375 (balena engine) of the device, local mode pushes should work. I just tried this and it seemed to work:
first enable local mode on the device
then use balena tunnel to forward the 2 ports I mentioned to a local port of the same number on your workstation
balena tunnel <device_uuid> -p 48484:48484
and in another terminal:
balena tunnel <device_uuid> -p 2375:2375
in another terminal, do the balena push to localhost (as you’ve forwarded the device ports to local ports of the correct number):
balena push 127.0.0.1 (use --debug if you want to see whats happening)