17 cities each having more than one users in there office so clients means small networks.....You said that Approved IP connections should be allowed, than this means we should have static IP's on each client .... this will add extra cost.....

Why this static IP thing? What will be the consequences of not having static IP?

VPN would have been a good option if the cost isn't that high as it would be more easier for us at Head office to manage the network all over the country.

logon to the server and then connect to the database
What you mean by this? can you elaborate it a little bit.