IPSec and Remote Certificates

I'm trying to setup a IPSec secured network using Windows
2003 Standard Server. I have one network card for the
Internet and one network card for the local workstations.

What I wish to do is to disable all automatic certificate
enrollments of any type. But from what I read I can only
create certificate for remote systems while they have been
connected to the local network directly, which is not
possible in this case.

I'm after a way that I can create on the Windows 2003 Root
CA the workstation and user certificates without the
remote workstation or user coming anywhere near the server
or local network. It's because I have the problem that
several workstations are interstate and can not be
connected to the local network and I can not open the VPN
server for unsecured connections for them to connect. I
can transfer the certificate file by secure means to the
remote workstations for it to be installed. I do know the
workstation names but not their internal IDs.

Is this even remotely possible?

Lance