When you invoke ssh on your NIT, do so including a tunnel descriptoin, such as:
-L5901:localhost:5901

This will open a tunnel on port 5901 on both ends (maybe you will want a different port on each end). This causes the ssh client on your tablet to listen for local connections on port 5901.

Once the tunnel is established, you can VNC to localhost:1 and your traffic will run thru the secure tunnel.