I would work through your IT department so that they can provide you secure connectivity and database support. I question the level of risk that you would likely create for both the security of your implementation and the database model based on your post.
To answer your question, dynamic DNS would allow you to contact each machine by URL even if their respective IP addresses change. Again, I’d get IT support for a holistic strategy for: remote access, database support, backups, the “thin client” model, and your security architecture in general.