I suppose you're talking about a TDE or NCP.
These will require a VPN. NAT is not supported for extensions on the TDE/NCP, or at least it is not supported natively.
You should then use a VPN router, or use a session border controller.
Another alternative is to use NS1000 attached to the current NCP/TDE chassis; starting with version 3, NS1000 will support remote phones natively, and the WAN port will be working (it is now disabled on v1 and v2 units); attaching the NS1000 is done by purchasing the connection card for both systems, and will allow to use all the TDE or NCP hardware, which will be managed as partof the TDE.
Honestly, makes sense only if you need other NS1000 features, i.e. voicemail, which you could get only installing a TVM50 (which does no longer make much sense); if it's just for one/two extensions, consider a VPN.