TMS is strictly for management. Usually its not required to expose TMS to the public, unless you have a specific reason to. As far as MCU, it registers to VCSC. External users call into the MCU (you have to create search rules to direct calls to the MCU). There is a deployment method to put the MCU in DMZ but personally I havent seen a need to. All my use cases were fulfilled using search rules on VCSE <>VCSC <>MCU. Not sure what clients the remote workers will use but if they use Jabber for TP (Movi), they will register to the VCSs.