With the new phones with VPNs you can also do a stepped provision.... One provisioning service for the vpn and another for the sip that can only be reached with the vpn. This is advanced stuff so take your time and learn about the tech.