You say "I want to provide remote work solution to devs on my team" but it seems that network-management is NOT under your direct control, as well as you are UNABLE to directly expose "your" services to the Internet (in other words: you cannot have YOUR VM directly exposed on the Internet). From the other side, your personal-computers/workstations DO have full Internet access.
If the above is correct (if not, please "comment"), your scenario is quite complex and a detailed discussion surely require much more space than what's taken by this answer. Anyway, as you seem to be interested in "pointers" ("...thanks for any pointers..."), here follow my suggestions.
" I want to provide remote work solution to devs on my team "
VPN, definitely, IS the way to go. Full-stop.
Anyway, you said: "Our support has proposed a VPN solution (I think) that allow managers to have access to mails and directories but this is 15% of a developper needs"
I can clearly see a sort of "protocol mismatch" between you (the "developer guy") and network-admins (the "network-guy"): you (both) are not speaking the same language, and simply don't understand each other. This is an easy thing to fix:
write down a DETAILED list (VMs name, IP addresses, TCP/UDP ports) of all the services that your staff need to reach for their development activity and for all of them clearly state if it's "mandatory" (MUST), "desirable" (CAN) or "useful" (NOT STRICTLY NECESSARY). Please, take your time to fill such a list, doing your best in avoiding sort of: "I need full access to everything", as this is the best way to not solve the protocol-mismatch I mentioned above;
do your best in properly understanding what's offered by the existing VPN services. As a starter, you might kindly ask for details. Please note that what you describe as: "VPN solution (I think) that allow managers to have access to mails and directories" is definitely not enough and show a sub-optimal understanding of the existing service (this is, again, a significant problem as for the aforementioned: "protocol mismatch" problem). As starting points:
- are you and/or your staff members entitled to be assigned a VPN-access to company network? if no, why?
- if yes, which servers/services (IP addressed and ports) can be reached when connected via VPN?
- should your "MUST" & "CAN" servers be missing, which is the proper way to ask for the addition of new servers/services to be added to the VPN-enabled network?
Once the above two points have been solved...
- do your best in describing to network-admins that modern software-development practices DO require access to services that need to be shared among the team (issue/tracker; build-servers; test-servers; CI/CD platforms; etc.), enhancing the concept that those services should be tightly binded to the development team and, as such, decoupled from any other company network/services. Obviously I'm assuming that your developers do NOT act, directly, on "production systems" and that you already have in place a proper development chain, whose first stage are made exactly by the mentioned development servers/services (as such, completely decoupled from "production"). The final "goal" is to have such systems "confined" inside a proper/dedicated network-segment so that such network could be granted VPN reachability.
If during the various discussions you'll be told about any kind of "security policy" that effectively "prevent" the required modification of VPN-service/policy:
keep in mind that "ICT security" is a key-component in almost every business. Anyway, its application is not a general "yes" or "no": depending on the company, on the business and on lots of other factors, "ICT security" can be applied (by network and system admins) along a "soft"<=>"hard" scale, with lots of points in-between. So, if posed in front of a "red-flag" raised for generic security concerns:
try to convince the other parts that you're requiring remote-access to systems that should be considered "owned by DEVs", and not affecting PROD, in any way. So, if they are "shared", they need to be splitted, regardless of the access (aka: if there's a security concern, than it applies ALSO when accessed locally, within the company). So this could be the proper timeframe to redefine networking and security boundaries;
DISCLAIMER: THE FOLLOWING IS A VERY RISKY/DIFFICULT ARGUMENT, TOUCHING SEVERAL KEY-ISSUE OF COMPANY POLICY. PLEASE: TREAT IT ACCORDINGLY!! if all the previous discussions failed, you could discuss about problems caused by unlimited Internet access already provided to DEV-team workstations: basically, from a technical point of view (let me insist on the TECHNICAL point of view), every developer can already use "remote-connection" software on his/her own PC, to reach such PC remotely (just search "Remote Access Software" on your preferred search engine). Actually, if you really have an unlimited Internet access, you could even host YOUR VPN-server OUTSIDE the company network, and build a whole "VPN-network" hosted 100% OUTSIDE the company, with an endpoint hosted on one of your workstations. I'm not going to get down to this path.... as I really think it's NOT needed. But you need to know that: 1) with an unlimited Internet connection, it can be done; 2) I bet that this is 100% NON-COMPLIANT with company policy so, again, you should avoid it.
I'm going to stop here. As I said, those are only "hints" to help you reaching the goal to negotiate a proper access to the existing VPN-service