Pat,
Have you tried connecting to project web access from home without a VPN? It is possible that it could work and if not then the VPN would be the way to go.
As far as limiting what this account can do goes, you could add the account (project server or windows authentication doesn't matter) to the Administrators group, not assign them to any security categories and then deny everything under Global permissions EXCEPT "Manage enterprise features". This would allow this account to check in projects and resources, update the OLAP cube and manage versions. The latter two things you could easily train someone to NEVER, NEVER, NEVER do those things - unless someone asks them to I guess.
Hope that helps some.
Earl
We have had several instances where a PC will lock up during a session
that someone is using after hours. Once that happens the user is
locked out of the project file until the next day when I come in and
check-in the project file. The Support Center would only check-in a
file upon the request of the file owner. One user is on a laptop and
has repeatedly locked up her PC with her project file open, then she
cannot get back into her project file. We are trying to find a
solution. One request is to give me (project administrator) access
from my home PC so I can unlock the files. If that is done do I need a
VPN?