A site-to-site VPN will allow you to set up phones just like they are on your main 3CX server site. We won't go into the details of setting up a site-to-site VPN, as that is a standard networking skill you can find elsewhere, but you can see the overall setup in the following figure. I will note that using a VPN will have the added benefit of securing your VoIP conversations which is becoming increasingly important. A VPN will also require slightly more bandwidth overhead. With the site-to-site VPN method of connecting remote phones, it is much simpler to add more phones and avoid NAT issues entirely.

Snom made the Snom 370, which includes a built-in OpenVPN client. As of this writing, this is the only VPN-capable 3CX supported phone that I know of. The remote phone connection method is beneficial because you don't need to "unsettle" the existing firewall infrastructure that may be in place at your organization...