Double NAT or get a separate work connection for a user working at home?

I have a user who works at home. Need to get a firewall installed.

Setup -> Users Telus Router/Modem -> Firewall -> IPSec Tunnel to datacenter

Is it better just to get a separate connection for work and connect the firewall to that?

Is an IPSec Tunnel possible on a double nat? Is this bad practice?

192.168.0.1 is the Telus Router/Modem

192.168.10.0 is the Fortigate firewall network and the firewall IP is 192.168.10.99

On the Telus Router I have 192.168.10.99 4500 UDP forwarded and 192.168.10.99 500 TCP forwarded