SSMS connections not using KERBEROS over VPN - why?
Assuming the client has SSMS 2012 installed, you might have one of them try running the following from a command-prompt as a test:


  %SystemRoot%\System32\runas.exe /netonly /user:DOMAIN\Username "%ProgramFiles(X86)%\Microsoft SQL Server\110\Tools\Binn\ManagementStudio\ssms.exe"


If they have some other version of SSMS, you'd need to replace the "110" with the appropriate version number, such as 120 for SSMS 2014 or 130 for SSMS 2016, etc.

If that does work, and you are so-inclined, you could use my answer on StackOverflow to create a small User Interface for your users that could prompt them for the domain\username\password then launch SSMS using netonly authentication.  This would essentially mean they wouldn't need to run the "runas" command manually.