[Thank you for answers. I am adding more information to my original question]
We have a Python App that is deployed across several customer locations. It is not feasible to set up a VPN between our servers and the client machines.As we add new features, we want to push it to our existing customers. We are looking for something similar to how on the air updates are handled. I understand this is not a new problem and was hoping to seek some ideas on how it has been handled so far..
A scalable to solution to this would be to embrace server orchestration. This will allow you to decouple the process of pushing updates to your app, from the infrastructure in which it sits.
Ansible is my favourite solution in this department. Other popular solutions are Chef of Puppet.
A common and sensible component of server orchestration is Push to Deploy. Your master branch always contains production code.