I supposing you are using Alwayson AG with a SQL server enterprise edition (because you are in a business critical production environment). Why don't you add the DR instance as a node of the alwayson AG cluster? It's free and included in the license you already own.
Instead if you are using basic availability group, you are limited to one copy.
So you have to look up for something like log shipping.
Log shipping is based on a share that plays as a repository for tlog backup between primary and distare recovery site.
After saying that, you have to evaluate that the source environment is composed by two nodes that have to use the same repository for LS tlog backups. So a network path is more friendly and reliable.
The risk of having someone to disrupt the share you created is something you have to handle with security and rights in your environment; it should not prevent smart architectural choises.