Remote thin client management over vpn

Hello, I was wondering if/how other people were addressing this issue.  We have alot of users that are remote and connect via vpn, that we want to convert to these thin clients/VDI.  However, how do I patch these? Since they're remote and have to VPN in, when I try to push patches with the WMS, it reboots the client and then goes to the screen that doesn't allow any user interaction, so the user can't connect to VPN and the patching process can't finish.  Also, it'd be preferable that patching can be handled without user interaction.  Will I need a third party tool for this? Is it possible to put a second repo on the dmz, and is it possible to have remote clients get files/patches pushed from that second repo?