What are our options for remote IP phone off of an IP office, customer wants to use 9608G:

Port fowarding?
VPN / Ipsec client built into the phone
SBC if we use SIP phones? Is that correct?

Customer is convinced there is some other Avaya part (I call a MAGIC box) that will auto associate phones remotely. I am unaware of such a device. System is preferred edition, R11.

Customer currently is using vpn appliances at user's home office and doesn't like it.

9608 will only support h.323, so, you can do VPN
You can do h.323 port forwarding, which not many, if any hackers scan for.
Or the best, but requires J100 SIP sets, SBC.
You can do port forwarding on SIP as well, using non standard ports, but SBC is always better.

The built-in VPN client of the 9608's is quite finnicky - it will not work with your average IPSEC or L2TP VPN. We have been successful in connecting them to Netgear VPN routers in the past...