Setup ssh_config with proxies when AllowTCPForwarding is not allowed

Question

How can you write the following setup in an ssh config.

### The Bastion Host
Host bastion-host-nickname
  HostName bastion-hostname

### The Remote Host
Host remote-host-nickname
  HostName remote-hostname
  ProxyJump bastion-host-nickname

### The Remote Host VM
Host remote-host-vm-nickname 
  Hostname remote-vm-hostname 
  ????

I have a bastian sever through which my remote-host can be reached via ssh. This connection is working as expected. On my remote-host there are a few virtual machines (the remote host vm) that can also be reached via ssh.

AllowTCPForwarding is disabled in the sshd_config of the remote-host. Therefore neither an SSH tunnel nor a ProxyCommand can be used. With both you get the error message "... administratively prohibited". The sshd_config should stay that way.

My preferred approach is that I connect to the remote-host and execute the following command:

[@remote-host]
"ssh -t -i keyfile user@remote-vm-hostname \" whoami \ ""

How can I describe this ssh command in my ssh_config? Especially so that this ssh command can only be executed on my remote host.