Need help with Internet Based Management

Question

I work at a small university that just deployed SCCM 2012 R2 recently.  We are currently using it on our intranet in HTTP mode.  We would like to setup internet based management so that we can start managing and deploying software update to laptops
that wander off campus.  At the moment we have a primary site server that manages all of our clients.  It's my understanding that these are our options:
Use some type of reverse proxy on a DMZ that will forward requests to our internal primary site server.
Setup a second server on a DMZ that will serve as a management and distribution point.  Since there is a requirement to have this DMZ server joined to a domain, we would poke holes in the firewall so this server can communicate with the primary site
server and so it can be joined to our internal domain controller (obviously bad security practice)
Setup a second server on a DMZ that will serve as a management and distribution point.  Setup a domain controller in the DMZ unrelated to our internal domain, so the SCCM server can be joined to a domain.  Poke holes in the firewall so this server
can only communicate with the SQL server on the internal primary site server (more secure than option 2).
Setup a DirectAccess server in the DMZ and have clients use DirectAccess to access the internal primary site SCCM server.
Have I covered the main options here?  I would love to implement option 4, but not all of my clients are using Windows 7 Enterprise.  A lot of my clients are still on Windows 7 Pro.  We are no longer deploying the pro version, but we are stuck
with the current ones for awhile.  The other issue is that we also have some Mac OS X clients that need to be managed as well.  Unfortunately, I have to eliminate this option for now.  Would the recommended solution be to use option 3 seeing
that option 2 seems very insecure?  This whole internet based management seems very confusing to me.  If anyone has any suggestions or can point me to a good step-by-step guide that would be awesome.  Thanks...

Answer 1

It all depends on the (security) requirements. In most cases it indeed comes down to either scenario 3, or 4.
For some more information about the configuration see:
http://www.petervanderwoude.nl/post/five-key-configuration-steps-for-implementing-internet-based-clients-in-configmgr-2012/;
http://www.systemcenterdudes.com/internet-based-client-management/
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude
Some question about option 3.  Is the domain controller in the DMZ just a dummy one?  In other words,
does it just exist because of the requirement that a site server must be a member of a domain?  Are there any trust relationships between the DMZ domain and the internal domain?  Also what are the ramifications of joining the DMZ site server to the
internal domain?  My boss want to cut back on the number of virtual machines to spin up.  Would installing the DMZ site server and domain controller on the same virtual machine be an acceptable compromise?