Setup wireguard or tailscale on a small pc, NUC , or raspberry pi ship it out to them, and have them plug it up on their end and you can remotely connect to open ports if needed. I think tailscale should not need port forwarding but wireguard may require it.