Thanks for all the advice.
As we're going through a firewall, we can't really do IP spoofing and (after some other design considerations) can't move the syslog-ng to be alongside the NPM server.
Solarwinds confirmed the operation of the Syslog Viewer, so short of a feature request (unlikely), we're going to stick with having our IOS based devices syslogging to two places (NPM and syslog-ng), and will do without RTCN for ASAs.