What part of the OSIsoft stack is behind the firewall?
If your clients are not on the production side, you will need just one hole in your firewall.
Please refer to this document: techsupport.osisoft.com/.../article.aspx
I use only clients like process book Display SMT, and own writen VB6 wrapper using PI-SDK for fetching data for user application.
The wrapper and our application communicate via COM on office side. In future there not will be any communication via COM
from our software to production side. Next step is, change some application to VB.Net