Nadia,
It is common to expose caTissue or OpenSpecimen to collaborators in
external centers.
You can expose web application server outside the network (as mentioned in
your mail). The web server can be hosted in the DMZ and database within the
VPN.
~Sri