So which end do you want DD-WRT on? Both?

You haven't really told us what you want it to look like. Well I can't quite get it. Currently they port forward from their external IP to the printer?

Do you want DD-WRT at the printer end and users connect to that?

I would recommend a VPN of some description at best, however you could set it up so it *only* allowed port forwarding from specific IPs/ranges to the printer to provide *some* element of security.