KACE Product Support

Another Option -which requires a major change- would be to publish the System Management Appliance to allow clients outside your company LAN (Sales Representatives and so on) to work from afar without the need to use a VPN solution. Once they have internet Access the kace agent will connect to your (then) published appliance. 
Which in turn allows you to publish patches to these devices. Just keep in mind to restrict the patches you provide -due to bandwith-issues- to the bare minimum (aka security patches only).
When you use "Patch on Demand" you might be able to provide even feature Updates but this should be well tested beforehand.    

to patch the agent needs to be connected to the appliance.