Firstly, I want to be sure that if someone scans my networks and he finds some IPMI cards, he won't be able to get control of it.
The BMCs on Supermicro systems have had some particularly nasty bugs within the last year. Make sure your systems are running the latest firmware, which addresses most of the bugs like the 'anonymous user' bug and the Infamous cipher zero bug. Note that these firmwares are only available for recent motherboards (The X8, X9 and X10 generations; usually not for the X7 generation which was being shipped 3-4 years ago), so your hardware will need to be modern hardware.
Even with the updates, Supermicro's IPMI is still subject to bugs. Passwords are transmitted over the network in the clear, etc. In my world, IPMI must absolutely be on a private network and available only from a few special management nodes.
I know it's a good practice to use IPMI only in local networks without public, however clients won't be happy about using VPN to access IPMI much.
IPMI is a great management tool for system administrators. By it's nature, this means that its also a nice backdoor for hackers. If I gain access to the IPMI network, I can do interesting things like power off all 200 machines within a few minutes, or tell every single node to PXEboot upon next boot (and potentially overwrite whatever is on the disks at the time). If you can explain this nicely to your customers, they might see the wisdom of a VPN.
Secondly, you can use ipmitool command to manage IPMI configuration without user authentication. I'd like to prevent customers of changing IPMI setting - e.g. IP address, removing my monitoring users, ...
Make sure that
ipmitool, FreeIPMI, etc. are not installed by default on the system. In your customer documentation, add a warning that installing these tools on the OS is a potential security problem and if they install these tools they assume some of the risk.