I agree that RSA keyfob devices and VPN may be the best option given the size of your company. At my company they use Cisco VPN Client on the user’s pc to connect to a VPN server for authentication prior to allowing them to access to the internal network. Just check with the provider to make sure their VPN portal will work with the VPN program you chosen as some providers haven't worked well with the setup within my company.

I think the cost of the software and hardware needed for Citrix is a factor against it at this point but as your company grows may become an option. Just asn an FYI, Metaframe XP/ nFuse can allow one to log in using RSA so if you go this route later the keyfobs could still be used.