I'm considering setting up a ZCS server in our small charity office but I need to understand if it will do what I need

What we're after is a way for workers on the road to log into the server across the net and get emails, calendars etc etc but security is a concern (inevitably!)

i worked somewhere before where they had a similar setup - admittedly for email only - where the mailserver served up a webmail interface and incoming requests on port 80 were redirected to the mailserver - until it got hacked because of some flaw i never understood in the way the webmail was implemented

If we go down the ZCS route I'm thinking the workers will use the Zimra desktop client to log in - in which case what ports do we need to forward and can the entire connection be run over an SSH tunnel or something similar ? And how 'dangerous' would it be to have the port(s) sitting open ?

Thanks for any advice anyone can give