We also investigating the best setup.
On the moment we have a sort of call home system the remote is a linux applianceand the control node is in docker.
The remote appliance makes a ssh tunnel to the main and we use the controle node trought that tunnel.
On the firewall's the ip's are added to the rules.