Someone else might have some ideas on how to protect an Exchange server.
A VPN would probably be the safest approach, but also cumbersome for the end-users. Otherwise, you will have to expose the web interface, IMAP, EAS and whatever client protocol you need, to the internet in some way more or...