Without thinking about it too hard, I'd choose super-secret option #4: put a VPN endpoint box in a DMZ. Then have the remote clients use software VPN endpoints to connect to it.

You should be able to find a turnkey solution for this. Not sure how much you want to spend. You could also install something yourself, likely for free plus a lot of time.