Elastix - how to allow a user from an external network to use an internal one for IP telephony?

Question

Telephony

There is a PBX with Elastix on board. After the hack, all allowed IP addresses for all extensions were limited to the external IP of the office (let's say XXXX, it's important that this is an external IP, not an internal one).
But there are users who need to be granted access from other addresses (YYYY). The addresses are dynamic, that is, simply creating extensions will not work.
I see several options for solving this problem:
1) Proxy server on the machine with Elastix. But does it pass SIP?
2) DynDNS for users outside the office. The question is expediency, because changing the external IP of these users is only necessary for IP telephony.
3) NAT. Same question.

Answer 1

Maybe a VPN?

Answer 2

I think we need to figure out what caused the hack. So far, we have not had a single case, although attempts do not stop. Periodically we cut on the gateway.