You are seriously overthinking it...
For remote users, generally nothing needs to be done on the remote end, standard router, NAT, basic firewall, etc, are all fine... generally nothing needs to be "opened up" or port forwarded in your standard SOHO router (Linksys, Netgear, DLink, or embedded DSL modem router). Note if you are building a VPN tunnel to the main location, these requirements change, but that doesn't seem to be the plan here.
On the 5000 end, port forwarding needs to be done on a range of ports to the 5000, including:
67&68/UDP
69&20001/UDP
6800-6802/TCP
3998&3999/TCP
50098-50508/UDP
6004-6261/UDP
You also need to make sure the System NAT address (ie. the public IP address of the router forwarding ports to the 5000) is set properly in TWO places:
System\IP Settings\System NAT IP Address
System\Devices and Feature Codes\IP Connections\P6000\NAT IP Address
And to finish it all off, on the remote phones themselves in:
System\Devices and Feature Codes\Phones\<Ext num>\IP Settings
Change the NAT Address Type to NAT.
Boot the phone, hold down 7 and enter Teleworker Mode, enter the public IP from the System NAT Address above and all should be happy in the world!!!
If you are using G.711 (uncompressed) CODEC, which is the default, that is all that is required!
The IP Networking Licenses are to network together multiple 5000 controllers using Inter-Tel Networking Protocol, these are often included in non-networked systems because they are typically included in "bundles" that vendors sell.
The Class "D" licenses are the licenses for Mitel IP Phones and will be automatically and dynamically allocated as needed to phones currently online.
