Setup a JSS web app in a DMZ and use it in conjunction with a public facing distribution point. We use a cloud DP at Amazon for this purpose.
We've had ours open to the web for years. Be careful to follow the steps in the article posted by dan.snelson exactly, especially the keystore. I messed up our cluster by being a little to hasty with those steps.
Our current setup is to host the DB on a separate server from the JSS Tomcat installs. Those sit in the DMZ behind a load balancer. Works great. I pushed out iOS 10 updates over the weekend when everyone was at home using their own bandwidth.