I would not open remote access, nor is it required for remote service observing.
In your route to command, you need to put in the FAC for service observing and the vdn you want to SO.
So make a VDN for this service observing feature ie: 5987
Lets say your FAC for Service Observe is *87.
The vector should read:
1. wait-time 2 secs hearing silence (old school habit)
2. collect 4 digits after announcement 3001
3. goto step 10 if digits = 1234
4. goto step 11 if digits = 5678
5. goto step 12 if digits = 1122
6. disconnect after announcement none
7.
8.
9.
10. route to number *874100 with cov n if unconditional
11. route to number *874101 with cov n if unconditional
12. route to number *874102 with cov n if unconditional
4100,4101,4102 are the vdns you want to be able to monitor
1234 is the passcode to monitor 4100
3001 is an announcement saying "please enter your passcode"
If you want to make this even more secure, don't use a DID for the dialin number. Make it an internal VDN, create a voicemail with the same ext and dial it through audix.
If the SO is always from one or several fixed locations (ie your supervisor home, customer office, managers cell) you can do security by validating the ANI (caller ID) and VRTs.