There are no additional ports to open. The issue with most softphones is their location awareness. This is to say that they are mobile and will use different networks by which to try and reach the UCM. When on a local network, there are no firewalls to traverse and the UCM is reachable by using its private network IP.
When leaving that environment, the dynamics have changed as you no longer control the local firewall (your firewall back at the office is now the remote and you do have control of that one by virtue of the port forwarding you installed). Additionally, you are no longer trying to reach the UCM by its private IP, but rather by the public IP and you control nothing in between either.
The key is for the Wave to know where and how to contact the server. Please refer to the manuals for added info as we only know that it works fine in-house and not elsewhere, but have no idea of how it was configured and what the settings are. Look at the NAT section in the manual as this is the area most commonly impacted by one-way audio although some carriers may alter the signaling as well.