I dont understand how what you propose successfully traverses NAT. Just curious: How do you punch through, and then keep your NAT pipe open?

There is no guarantee that this part: "our VPN assigns each user a public, routable, IP address, on the outside world, such as 72.10.x.y.z" will always lead back to a client behind layer(s) of NAT, unless the listening port is manually forwarded in the router itself.

Protocols such as STUN have developed methods to attempt to solve this, but its not easy because of issues such as there being no standard for the amount of time that NAT must keep pipes open after they are finished being used.