You have almost answered your own question; it seems that the only part you are confused about is whether "the reflection principle operates outside ZFC."
One must, as always, distinguish between the formal system whose properties we are analyzing (in this case, ZFC), and the theory inside which we are making our arguments about said formal system. The latter is what we call the "meta-theory." When you ask if Con(ZFC)→Con(ZFC+¬CH) can be proved purely within ZFC, this can only mean: "Can the meta-theoretic argument itself be formalized in ZFC?" Note here that ZFC is playing two roles; it is the theory being studied, and also the (meta-)theory being used to prove things about ZFC. It's important to not to confuse these two roles.
Now, the reflection principle takes place "outside ZFC" only in the sense that it is being used in the meta-theoretic proof of Con(ZFC)→Con(ZFC+¬CH). But this doesn't mean that the meta-theoretical argument can't itself be formalized in ZFC; in fact, it can, and in fact it can be formalized in much weaker systems (I think primitive recursive arithmetic suffices).
For more explanation about how to prove Con(ZFC)→Con(ZFC+¬CH) finitistically, I'd recommend Chapter VII, §9 of Kunen's book Set Theory: An Introduction to Independence Proofs.