Hi,
You have two options:
1. Install and configure the OpenVPN module, so the domain users can connect through VPN to the Zentyal server and then access their personal resources.
2. Create a rule in the firewall that allows certain IP addresses to the Domain Controller module.
The best option by far is the first one, but if you do not want to use another module and you do not bother to change the public IP of your clients constantly, it should work as well but it is not as safer as the first option.
--
“This world is ours, and by the Holy Light we will keep it safe, now and forever".