Good idea to make it work internally first.
Depending on the version of the MCD, i will presume its new ish, you will create a user. device type generic SIP, give it a number and name.
On the access tab under user and device enter a simpish passCODE.
Then in the MBG when you create a SIP teleworker.
It has two sections for passwords. LAN side (internal you just created) and WAN side (Just enter a more secure passCODE)
So in short your SIP client will use the WAN side credencials to authenicate with the MBG and then the MBG will authenticate to the MCD using the LAN side credencials
Sorry for my spelling im a bad typer always in a rush
Hope this helps