** Update **
Just got an email reminding me of my post years ago. Random. We didn't find any solution for our end users when running VPN. Instead what we do is upload the data as a service to ArcGIS Online and then have the end user log in to ArcGIS Online. This helps prevent an access to our local servers, and puts all the use onto Esri's equipment. This also eliminates the amount of times the user has to login to various services.
The other way I figured is you could put all your data/servers on the Internet so the users could access the data. This seems like a more expensive way to go with time, equipment, upkeep, and security than just using ArcGIS Online. I am still in the process of verifying that though. Hopefully this post helps someone. Feel free to ask me questions if needed.