There are two ways to do this, the simplest is to use the existing VPN. Assuming your network is properly configured, it should require nothing more than putting the remote phones in Teleworker mode (Press and hold 7 well booting phone) and entering the 5000's IP address. The routers should take care of the rest. Note that both routers must be aware of the voice VLAN at the main site, you can test this by trying to ping or web connect to the 5000 from the remote site, if you can't the phones won't work and you have an internal network or VPN configuration problem.
The alternative is to go outside the VPN, routing voice traffic directly through the Internet... To do this, you must do some port forwarding in the Main location's router from your public IP to the 5000's IP.
69/UDP, 20001/UDP - Used for TFTP of firmware to phones
6800-6802/TCP - Used for basic call control with MiNET phones
3998-3999/TCP - Used for phone applications and button functionality with MiNET phones
50098-50509/UDP - Used for RTP (audio) to the MiNET Phone
6004–6261/UDP - Used for RTP to the 5000 processor module
6604–7039/UDP - Used for RTP to the 5000 PEC1 (used only if you have a Processor Expansion Module)
Once you have done this, you need to program the public IP you port forward from into the phones Teleworker mode -AND- into the 5000 in System-IP Settings-System NAT address and System-Devices & Feature Codes-IP Connections-Pxxxx-NAT IP Address. (Pxxx is the extension of the local Processor Module, typically P6000 or P6001)
One last step is you have to tell the 5000 that those two phones are remote (meaning NAT'd devices), so in each extension and into the IP settings and change the NAT Address Type from Native to NAT.
EDIT: After reading this a little more, I had some concerns with my answer, although technically correct. The real question here is, how is VLAN 2 configured? Is it completely self contained within the HP switch and doesn't touch the outside world or are both subnets configured in the router and it routes data between them? If VLAN2 is completely self contained, there are definite network changes that need to take place for either solution, but there are multiple ways to tackle it depending you your answers, so I will leave it at this for the moment.
