The current scenario is not supported by Microsoft. You will either need to turn on IFD and use ADFS to control access or connect via VPN.
Your current scenario exposes CRM and all your data directly to the internet and poses a security risk.
You could use something like a product called ADX in a DMZ and that could limit access to your CRM data (while the CRM server itself is not exposed to the internet). You could then develop custom forms and views with ADX that you could expose to selected
users when they log in.
Jason Peterson