WSUS - Planning and remote users

You could always setup a web facing WSUS server for the external clients. Not something I've ever seriously looked at but there's no reason it should cause any issues. In this instance I would be inclined to setup WSUS just to manage the updates and not to host them. This way you can manage the updates centrally but they'll still be downloaded from MS, saving you bandwidth.

With regards to the version of windows server, there's no need to upgrade. WSUS is simply a database of updates synced with Microsoft, if they are available on Windows Update they should theoretically be available to the WSUS server whether it's running Server 2012, 2008 or even 2003. Just make sure the WSUS software is up to date.

Web server not an option unfortunately.

Have you gone through this one?

http://technet.microsoft.com/en-us/library/bb418851.aspx

Fall back although useful, isnt  going to help, as when user is on VPN they will still see the WSUS and drag updates across VPN rather than heading to microsoft.

So you want all your users to point to Microsoft only? Even though they connect to VPN?

Basically I need some how to change the server they are looking at depending on whether they are in the office or at home. when they are at home they could either connect to a wsus server at our VPN termination site or go to Microsoft.