How do I set up secure access to the Company Portal?

Question

System administration

Good day to all!
There is a corporate portal 1C-Bitrix. It stores all information about the company, customers, etc. Lots of confidential information.
The network architecture is as follows:
- a Mikrotik router with an L2TP + IPSec VPN tunnel
- a computer, ala "server" with Windows Server 2012 (AD with policies configured)
- a Bitrix virtual machine on the same "server"
The server itself is in a separate place, remote from office. Between office and "place" the VPN tunnel is lifted. Remote users can also connect via VPN.
Everything works well and it seems even convenient, but there was one BUT. There was a need to connect to the portal of customers and partners. And they are already uncomfortable / impossible / reluctant to create a VPN connection. This raises the question: how to organize a secure connection to the portal with minimal risk of hacking?
There is only one option, as I understand it - to pull the site out. What to choose?
1. Hosting
2. Leave the site running on the same server
The authorities are afraid to place the site on the hosting, due to a possible data leak. I'm afraid to open access to the site from the server, because if they break, then everyone will break.
What are the convenient, high-quality, effective ways to gain access to the portal?

Answer 1

Use of ACL to external ip addresses at least. If partners do not want to do vpn.

Answer 2

Open external SSL access for partners. Set the server not directly, but through nginx with the http -> https redirect.
Bitrix is ​​perfectly protected from vlob attacks. You can put any snort in bridge mode - but this is paranoia_mod

Answer 3

It is possible to try through WS VPN, and to lift it directly inside. Tobish access will be only from under this VPN, and it will not look at the external Internet.