Would it be possible to set up a 2nd account, prefixed by, say, "R-" to indicate remote access and then use the keyfob? And limit the normal access to a normal sub-net?
If the account password cannot be set up as you asked, maybe this may work.
IOW - I don't have a clue.