How do you remotely support on-prem deployments?

No, don’t make this complicated, just get a standardized access model rather than creating a new system for every client. There are three options: accessing through a virtual private network (VPN; e.g., OpenVPN or Cisco AnyConnect), a bastion host or jump host, or utilizing services such as Tailscale/ZeroTier, where the server reaches out to you. The first option will work but will be a pain for each client’s IT staff; the second will be more secure and easier to control; and the third is definitely the easiest to implement initially because it avoids firewall issues altogether. If the company is a startup, I have seen it use Tailscale as its only method unless a larger client requires a VPN connection. However, whatever you decide to do, ensure you lock it down, allow access only via SSH keys (not password-based), limit access to certain users, and enable session logging. Moreover, inform clients about what will happen and what their responsibilities are before they begin working with you to prevent any future issues. The primary issue companies face is creating an ad hoc, temporary solution for access that eventually becomes a permanent headache.