Hi,
You need to be aware that SAP GUI use of SNC is not the same as SAP Router use of SNC. When SAP GUI is using SNC, it is at the application layer (user authentication / SSO etc.), but SAP router uses SNC to secure network transport layer communications, so is typically used to secure IP communications between companies (e.g. between your company network and SAP network for support). So, i'm not sure if SAP Router is right for your requirement. Instead, I would suggest you consider using a traditional VPN. The user can authenticate using the VPN and they can then access the SAP system using SAP GUI over the VPN tunnel (authenticating using SNC / Kerberos). This will also mean that (maybe in future if needed) the users can use other SAP applications over the same VPN tunnel, such as web based applications (web gui, nwbc, crm ui etc.). Also, when using a VPN the users can be required to authenticate using two-factor authentication, so you are providing stronger security controls for users accessing your SAP systems from the Internet.
Thanks
Tim