Someone else might have some ideas on how to protect an Exchange server.
A VPN would probably be the safest approach, but also cumbersome for the end-users. Otherwise, you will have to expose the web interface, IMAP, EAS and whatever client protocol you need, to the internet in some way more or less direct for them to be able to use it.