This picture shows how every person is connected: by mobile phone, by desk SIP phone and by computer, inside the company network and from outside through the VPN.

From a new user to a working phone — the administrator only creates the user; everything else is created automatically.

Inside the company network no VPN is needed. Outside, the user adds the VPN first (WireGuard QR code, or the OpenVPN file), then everything works the same.
A printable PDF of this diagram: QCW_Connection_Diagram.pdf.
Limits: the setup link configures the free Linphone app (not a signed native app); iPhone background ringing needs a push service; test with real phones.