There is two approaches here:
1- your staff are always at the same place with a fixed IP : you can set this IP in remote access in the server manager to allow access to this particular IP or group of IP. (Do not put 0.0.0.0/0.0.0.0 here as you will have some contribution that might rely on this setting and start to consider any IP in the world as local.)
2- your staff is either at a place where the IP is dynamiclly assigned or they move from place to place, then the beast approach as suggested Fumetto is to set up a VPN. One easy way would be to use openvpn bridge see
https://wiki.contribs.org/OpenVPN_Bridge on how to setup this contrib.
Jean-Philippe