Linksys → [Wired] Help with port forwarding for my reps

I am looking for some help. I'm trying find a solution to this situation:

I am hiring reps who will work from home. I provide them a VOIP-ready Linksys phone. Training is done in person at my location. Before giving the phone to them I program a telephone number in it. (I know how to program each extension, get SIP settings from my VOIP service provider, etc)

They take it home, plug it in, works fine.

But, down the road. I may want to add an additional line (extensions 2 thru 4). OR they might quit. OR I might fire them.

I need to have access to the configuration page for that phone for each of those scenarios.

It's my understanding that they need to forward a port so I can gain access remotely (am I using the correct terminology?)

My questions are:

How easy is it for me to help them set up port forwarding from my remote location? (can I do it for them via WebX or GoToMeeting?)

Does it present an on-going danger to their computer to set that up and leave it set up? I want to be able to access that configuration page at any time. If they quit/get fired, the only way to ensure they don't answer calls from my customers is to get in there and remove the SIP settings in the extension configuration on that phone. I've checked with my VOIP service provider and I cannot go to the service provider and ask them to change the username and password for that phone line, so I must take action on that configuration page to have control when employment ends.

I don't want to teach/show the rep how to configure the phone themselves or I lose control. I have set up a password on the admin login so I am able to access the configuration page, but they are not.

Thanks in advance for your help. I can be reached via email for more in-depth discussion.

That is correct.Setting up a port forward is a simple process and can be done with either WebX or GoToMeeting. No it doesn't have any impact or pose any threat to their PC.

There are two additional issues that must be addressed.
1) The client must have a public IP address that you can see remotely. (Not NAT'd)
2) The phone needs to be set up with a static IP address, so the router DHCP server can not change it's address.