Generally speaking, the "recommended" approach to allow external users is to set up Form-Based Authentication (FBA). There's multiple technical options to implement it (like adding FBA to the existing Web application, or creating an extension of the Web application).
However, for 4 users, I don't know if it's Worth it.
A simplier way is to create these for users as ActiveDirectory users in your Active Directory. Then publish your SharePoint through a reverse-proxy (like TMG).
One major benefit of this method is that even your internal users can now access your SharePoint from the outside. And of course, it's much more easier to implement than FBA...