In my opinion what would be good here is to have a public managed security gateway installed in your DMZ so that the OneAgents outside of the DMZ can send data to it which in term will send data back to your Dynatrace server. This will let you avoid having to open up your Dynatrace server to traffic from outside the LAN.
I think that should be all that you need. The OneAgents in the LAN should have no problem talking to the server directly.
In such a small environment I don't expect bandwidth would be an issue but if that were the case you could think about having a private security gateway located near your external OneAgents so that compression can help with the data they will be sending but that doesn't seem to be necessary here.
I would probably wait for some more input before making any changes though as my answer is based on my understanding in theory as opposed to experience.
James
