Is the expense a burden?
Having a static IP at your office site can really make your networking simple.
Allow the specific IP for administration and phones and allow the IPs for your SIP provider. You don’t even need responsive firewall, just the straight IP-filter firewall. You could even use DigitalOcean’s simple filtering to do it at the provider level.
Allowing dynamic IPs and/or setting up VPN is just a lot more work.