As I understand to do that I really just need to configure a SIP trunk on an Internet facing interface which basically routes all traffic out to a SIP provider via IP or A name. Does that sound correct and is that possible with the security feature set only?
Not going to work. Depending on your VSP (voice service provider), you need to ask them if they recommend turning on/off ALG. Most providers require ALG to be enabled but some recommend ALG to be disabled. ALG is enabled by default on Cisco routers.
Depending on your provider as well, you need to determine how many handsets do you want to configure. If there's only one handset and you're not doing anything fancy, then you can get your handset to register with your VSP without any problems.
If you want fancy stuff, such as line extensions, call routing ... then you need something more beefy.
