Remote Office in DMZ

Remote Office in DMZ

Some background, we have many autonomous business units with no connection back to us besides VPN. We want to supply patch management capabilities through ManageEngine. Is it possible to drop a remote office in the DMZ have the BU in that remote office and open ports back to the main console so they can manage their own remote office? 

Has anyone done a setup like this? Alternatively has anyone moved to the MSP model and can provide information on how it differs from Enterprise? 

Thanks. 

                New to ADSelfService Plus?