A better solution would be to upgrade so you can use SSL or other strong authentication mechanisms.
You can use the --network= option to manage the GCE network to which the working virtual machines are assigned. Take a look at the GCE docs on the net for details on how to set up a VPN (for example, a comment suggested by Elmar). You can also see the configuration of one machine on the network with a static external IP address and use it as a proxy server for other virtual machines on the network.
This is not a usage pattern that we tested, so there may be problems with the delay or bandwidth of the traffic through the proxy / VPN. Most likely, you will only need to send your traffic through this proxy server so that you do not accidentally capture the traffic used by each worker to communicate with the Dataflow service.