Comment by thel3l

That's exactly what we did in the end—used a commercial VPN and provided internet to the device over the USB cable. Could have probably used a Tailscale on a VPS somewhere too.