Or you could wrap ZEO traffic with SSL using stunnel or a similar program, assuming they allow restriction of traffic based on client certificates. This doesn't have the drawbacks of SSH or VPN.