obstacles:

• NAT to NAT
• users don't know their own IPs

Try use Tor onion services as a transport.

OpenVPN is hard to setup in a secure way.

Wireguard is not yet in Debian buster.

Options to try:

• SPICE originally developed fro KVM but can be used independently with

any Linux host. It was designed for high latency environments. It can
also transfer audio I think. remote-viewer implements it besides VNC:

• NX protocol: https://en.wikipedia.org/wiki/NX_technology

• Remmina implements it as one of its options (it also supports SPICE).

• X2Go

• Remmina seems to be the premier graphical remote support tool. Remmina usage guide: https://www.tecmint.com/remmina-remote-desktop-sharing-and-ssh-client/