The ideal solution would be a certificate based VPN that advertised a static local network via a dynamic routing protocol over the VPN. From memory you can do this with a Cisco VPN but probably also possible using an SSL VPN.  The VPN calls home so you don't need to use a direct APN, Static IP or DynDNS.

Not an easy solution to set up, but one that will scale if you think the number of sites will grow over time.