I have a Debian cloud server with Exim4 running and serving emails with DMARC, SPF, and DKIM properly set up. I can ssh into the server and send and receive encrypted emails successfully. Dovecot is running on the server and allows clients to connect over IMAPS and retrieve email from any location. In the update-exim4.conf.conf file, the "dc_relay_nets" setting allows email relays from a specific IP address at an office location. Outgoing email only works coming from that IP address. There is no VPN service set up to allow users to remote into the network behind the router at the IP address approved for relay. Users cannot send emails from outside the office.
I have the ability to put private keys or random passwords (which hopefully can be locked from user access) on all of the clients. Most links I can find only mention the option to specify relay networks or relay domains. What is the best way to provide users the ability to authenticate to the email server and send mail from any location? Exim4 has a lot of capabilities, so I'd be surprised if it couldn't do this. Am I missing a setting somewhere?