Creating a low-cost and scalable star network infrastructure

I am tasked with creating the architecture for an integration application for 2 systems.

I will be running a Ubuntu LTS instance, with an application that requires to connect to our clients MSSQL database.

The clients database will be hosted on a server, in the clients infrastructure, which one can connect to using Fortigate.

My question is about best practices and security when it comes to connecting 2 machines in different networks. As I understand there are many ways to do so:

1. Opening a random port on our clients public IP address directly to the clients MSSQL database is a dangerous move.
2. Installing Forticlient on our VM forces that VM to have only one tunnel to one client, meaning one client per one VM, which is very costly.
3. Setting up Fortigate router to create multiple VPN connections to our network, but the difficulty is configuring the devices to have non overlapping sub network IP addressing, as there are often times popular IP networks (such as 192.168.1.x.) taken.

What would be the best approach? The goal is to connect our server with many databases hosted at different clients servers within their networks. I am trying to avoid setting up any kind of VM in the clients network and push the data to us, as its more difficult to maintain many machines VS just one.

EDIT I do understand that not having a interface on the client side (for exmaple an API exposing the database) and connecting to the database directly through a VPN is a security risk, but I am trying to understand the trade off in choosing the VPN route, as I am limited in the time I have to create the solution.

The trade off being:

1. Time and difficulty to develop the solution
2. Security concerns
3. Scalability

The client is using Fortigate to manage his internal VPN, currently we are trying to create a site2site VPN connection

While most enterprise VPN technologies will use standard protocols, the configuration of these is hidden away behind a mountain of marketing spin, forcing you to use the same product on all end points. Sadly most of these are badly ported and very badly supported on Linux. That you start by mentioning products rather than protocols makes me think you're already getting caught in this trap.

Using "router" appliances is a quick fix but these are difficult to maintain security on and difficult to support if you are not already operating a fleet.

While if it were up to me, I'd be considering a mutually authenticated SSL tunnel terminated on the client application hosts, or at a push, openvpn/tails. But you need something your clients can support - we know nothing about that.

Talk to your clients and run through multiple failure scenarios - how does monitoring detect an issue? How do you run diagnostics? How does your client run diagnostics?