This has nothing to do with Windchill and you should not need to reconfigure anything with those environments. This is all about your IT environment. Internal to your IT network, I cannot see how a VPN would be needed but outside say remote or from home, you should always use a VPN. I am not sure why you would want to leave any environment accessible to the world unless you want it public.
If the requirement is as you state, then I think these instances would need to be cloud based or located in a DMZ if hosted locally. Either way, there is nothing that should change specifically for Windchill to enable other than setting up HTTPS but that is a security issue. Since its Dev, you want to make sure that you can not only access the web interface but also SSH to the system and port graphics back if Linux. Ensure you have a good build process for updating customizations. All of this is done via firewall changes.
