Is the server in your office accessable over the internet? It must be for the webserver to connect to it. If it is then Gary's suggestion would be the best approach to add a layer between the DB and the outside world if you expose your DB it needs to have as minimal surface area as possible and a user for the website with the minimal rights required.