Can you suggest a solution to implement the ADSelfServices Plus in public network?

I understand the ADSelfServices Plus is internal facing, as it need to talk to the AD. If I want to make it to public, which mean our user are able to reset their password in anywhere? Do you have any suggestion? Any security concern and recommendation? DMZ is one of the method, any other suggestion which can protect the AD being hack?

Thanks and regards,

Carmel Lee