Internet Accessible SEPM Server

I have several thousand Symantec clients that don't connect into the corporate office often enough to keep their status current in my SEPM manager. This complicates my ticketing system and Symantec licensing.

I have my client policies configured to try the SEPM server first, and if the SEPM is not available, they use Symantec LiveUpdate to get the latest signatures. So I'm not all that concerned about signatures.

Is there a 'Best Practice' for installing a Internet reachable SEPM server? I currently run three SEPM servers with a SQL backend database. This would allow those clients to get the latest policies as well as SEPM console commands.

All are 12.1.6 Version.