If you could get a hardware router (example: sonciwall firewall), with a vpn to work with the vpn for ISA server.... "site to site"... it could be done. It could be setup so that you still have an inside ip address.
What they are un-candidly telling you, is that they don't want to spend the money or put in the time to make it work, for a single user's phone....
Can it be done ?...absolutely !... I have users in remote sites all over the place using both hard and softphones.