[Samba] remote site options

[Sonic]

Currently using Samba 4 as AD at the main site and would like the main site
AD to authenticate users at a remote site (about 3 systems). As I use my
domain management system from a remote location via VPN I know this works,
but the VPN may not be the lowest cost in terms of overhead.

What other options are available?

I'm thinking that port forwarding between the sites may incur the least
overhead (which ports?). What are the common (and maybe not so common)
practices in place for this scenario?

Thanks!

Chris