Question Regarding Features

We are looking to moving towards DC for our remote troubleshooting and patching. I have a few questions:

- Does DC allow connecting to endpoints for remote management when those endpoints are NOT connected to our VPN?
- Does DC allow us to setup a software package to begin copying over to endpoints for pre-deployment? I.e. create the package and as endpoints connect, they will pick up the package?
Secondly, can this be done with only internet connection and not a VPN connection? I'm hoping that we can stage all our devices over several days as over 90% of our employees work in the field via VPN and WWAN connections. It is often very difficult to time any sort of software push as they only connect for a few moments and at random times throughout the day.