Is it must the ProxySG use BCAAA to perform user authentication to an IWA realm? .

Yes. 

No. 

It depends on whether that realm has been configured on the ProxySG to be an IWA Direct realm or a BCAAA realm.