We'd suggest the same to use conditional forwarders that would be a best choice in terms of security. You could later open the appropriate ports in the firewall.
Regards,
Bruce
ADAudit Plus Team