Update and manage Remote Laptop Users without VPN Connection

Hi,

we are using Enterprise Console 5.2.197 and want to update and manage our remote Laptop Users who only use an Citrix Client to connect to the headquarter.

The remote laptops get their updates directly from Sophos and once in a while they connect their endpoint in the headquarter an we receive their Endpoint reports.

Now we want to update and manage them directly through internet.

Seeing that we only have 5 remote Laptops, we don't want a big solution with Message Relay Server in an DMZ etc.

My idea was to submit the needed Ports for managment and updates directly through our firewall and NAT it to one of our public IPs or the be precise via: https://sophos.ourdomain.com.

Could please anyone help me how i have to configure Sophos to communicate directly through our firewall and if maybe anyone could tell me if this would raise a safety issue?

Greetings

Mario