Using Jenkins to create its own network paths is either clever or crazy. Right now I am leaning toward crazy, and trying to justify this reaction.
VPNs, particularly AnyConnect types, are normally maintained as infrastructure by network engineers and used for multiple uses. But it sounds like you want to deploy from inside your network to inside a customer network. Attaching a physical VPN between you is heavy-handed and likely to run into corporate road-blocks - if I've understood you correctly. Thinking of your problem as IoT causes me to suggest that you have your inside-customer device call up to the Cloud and pull down deployments, which you have staged in the Cloud. If your customer will give you an ingress port ( ours don't very often) you can have a two-way connection where the Cloud server pushes to the IoT device. But pull-only works well.
You can establish a VPN from your IoT device to the Cloud, and in fact, most today would demand that this connection be encrypted in some way.