-1
a) we have other parts in docs which cover this pretty much (see below)
b) if you mess up switch config, you won't be even able to connect to Horizon over external network. Basically we need to say that if external net is tagged, then please put tagged traffic into there. So if VNC proxy is inaccessible, but Horizon is, then it can be that PXE Admin network is used for VNC access instead of public (external). 

Check out the following sections of documentation:
http://docs.mirantis.com/fuel/fuel-3.2/user-guide.html#network-issues
" If you need to access the OpenStack REST API over Public network, VNC console of VMs, Horizon in HA mode or VMs, refer to this section: Deployment configuration to access OpenStack API and VMs from host machine."

"To access the Horizon and OpenStack RESTful API via Public network from the host machine, it is required to have route from your host to the Public IP address on the OpenStack Controller...."

We all said above, we still need to somehow restructure existing information about this issue to make easier for consumption and for googling (BTW googling for "vnc is inaccessible openstack" gave me the right piece of docs on first page, 4th link from the top).