Yeah, as has been mentioned, other than opening up your domain controllers to the outside world, which is kind of crazy, there aren't many options.
I love the idea behind DEP, but unfortunately, it was not really designed with the enterprise in mind, or I should say, not designed for enterprises that require users to log into directory level accounts. There is no way for a user receiving a new Mac enrolled into DEP that is setting it up from home to log into an AD account on their Mac, since AD join has to happen first, and for that to happen the Mac must be in range of your domain controllers. All conditions which are extremely unlikely to happen when someone is sitting on their couch at home with a brand new Mac.
So what happens in that case? They set up a local account, which is far less than ideal. Some of our users set up local admin accounts on their Macs after the fact, since we don't block anyone from doing that, but we don't want users creating and logging into a local account from the get-go! This goes completely against everything we're trying to maintain.
We have a different and custom setup process that works around these complications, but DEP would not fit well with the process we have. For now, we aren't going to be using DEP, and frankly, we may never be able to, since a large number of users getting Macs work from home.
