You mention devices accessing WMS via VPN, have you considered using WMS Pro (Cloud) version. You don’t need to set up any server except for a WMS repository for Windows and Linux images and packages. You can set up a 45-day demo for 25 devices, these devices can be managed on your local network and remote. I am happy to do a one-on-one call with you to see if there are any best practices I can offer.
Let me know if you care to chat…
Jim