Securing agent WAN access

Hi, sorry if this has been covered elsewhere - I'm struggling to work out how I can properly secure agent communication from a WAN network (the internet).

I have looked at the forwarding server, but it seems to require a split DNS setup which is not possible in my situation (I am part of a much larger organisation and do not have that degree of control over our DNS, and the majority of my systems including the DC server already are assigned public IP addresses, but are behind a firewall)

Is there a way of using a distribution/notification server to allow agents on the WAN to work that does not expose the main DC server to the internet?