I'm concerned about opening up the SQL server to the public internet

Allowing internet access to your database is common and very safe - More on Security

Will mobileRMS work with a VPN?

Yes, you just need a static IP or (Dyn DNS) where the server computer is located.

Is there an option to use the tablet / phone on an internal network?

No, your database will need to be accessible on the internet for mobileRMS to work.

Where do I change my SQL password?

You can change your SQL password through Store Operations Administrator under the database option, make sure you update connection settings on all registers after doing so.

Can I use a barcode scanner with mobileRMS?

Yes, you can use compatible Bluetooth barcode scanner. More Info