You can configure the Altiris Agent on the managed clients to connect either to an NS server (by locating it in a DMZ, by opening ports through your firewall, or by requiring the events to occur through VPN). You can set network bandwidth throttle settings so that the Altiris server will not overburden your clients' internet connections by sending patches or software packages over their slow wireless, home, WAN, or VPN connections.
Or you can configure it normally (as though your users don't travel), and then just let Altiris update them when they come back to your intranet.
Does that answer your question?