He can use SOA too, however the clients will have to be installed manually on the roaming machines.
The management server listens on port 25322 (TCP/UDP), so this port has to be opened/forwarded. Later he could download the installation package from ADMIN > Settings > Setup and install it on the client machines. Finally he has to change the server address from avast! Client UI > Settings > Troubleshooting > Administration Console > Server name / IP providing his WAN IP address and allow the clients to connect from avast! SOA > NETWORK > Group view (a message will be shown at the top).