Hi Neeta,
You have mentioned that the customer requires deployment on tomcat. You can do so via a war file deployment. But you still definitely need a reverse proxy mechanism to get around CORS issues.
The reason is that your oData services are hosted by the gateway server while the UI components are hosted on the tomcat servers. This combination causes the browsers to run into all kinds of security issues. A reverse proxy would translate all URLs to a single host URL and hide the fact that requests are going across domains.
You can accomplish this in a number of ways. Tomcat supports URL re-writing (a form of reverse proxy) or have a separate host dedicated to this task (a more secure and scalable mechanism). You are not limited to using WebDispatcher. Feel free to use the reverse proxy mechanism of your customer's choice.
thanks,
Nitin