Since I haven't heard of any custom firmware for the Sagems 2304n & 250N, and you haven't stated which of the Sagem routers is involved, I think the best solution might be to use a Cable router.
Take a look at this thread linked to below for who to link it to the Sky router. The Cable router would then be used to control the persons LAN and by placing it in the Sky router's DMZ, all the checks performed by the Sky router, and its firewall are bypassed:
A WiFi n 300Mb/s cable router can cost as little as £30.
For reference the specs of the Sky routers are as follows:
* all support 10/100Mb Ethernet LAN
* Sagem 2504 is WiFi g (56Mb/s)
* Sagem 2304n is WiFi n Lite (72Mb/s)
* Sagem 2504N is WiFi n (144Mb/s)
Any Cable router which is known to be fine with your company's VPN set up should be absolutely fine.
Why are the Sky router's like this? (i.e. don't work well with VPN)
I suspect it is because the Sky broadband network is designed primarily for the domestic market. However many people have been successful in using their own routers to work with VPNs, so it isn't a case that th traffic is blocked, just the router cannot support some forms of VPN.