Support helped with this and the solution was:
- ensure the latest firmware is setup for the Sangoma phone in the EPM
- ensure the PBX on Sangoma portal is setup with the correct redirection settings under the deployment, for us this was using the FreePBX local ip and http on port 84
- register the phone with the deployment
- Add the VPN client in EPM and then rebuild
- Factory reset the phone (when on the LAN)
Everything then worked OK, the phone got provisioned, tar ball got generated and the phones worked great off site using the VPN.