Orchestrator and Multi-Tenancy

I am using Orchestrator in a multi-tenancy environment.  What I need to try to do is:

Set up a master orchestrator instance where I can centralize workflow execution.

Set up slave instances in the different tenant environments that I can call with the Multi-node plug-in.

The problem is that the environments are separated and can only be accessed via a vpn tunnel.

how should I set up orchestrator master and slave to communicate over the vpn?

Should I:

1.  Use a "VPN connection plugin" if there is one, to establish a connection over the vpn?
2. Use the HTTP-Rest plug-in, and give both vCO's a public IP and some time of public web interface, if that can be done securely, perhaps sticking slave vCO's in DMZ's?

3. Some other way?

Thanks for input!