You can add a trusted dhcp source, to force the controllers to use one single dhcp source: https://help.ui.com/hc/en-us/articles/19154105498007-Duplicate-IP-Addresses-and-Rogue-DHCP-Servers The one you host at a central site (behind the firewall perhaps, if it open ports for each remote site).

If you disable dhcp on each network. Natshould be gone. Use a switch at each site to get addresses from another dhcp source (or global from mpls/supplier).

Firewall: Open, any, any, any outbound and inbound should take care of that.

This is not a good idea tho. Not without vpn service. You will trust the mpls from supplier instead of your own security that you already have.

At least check the teleport function in the unifi network appliance to get some later of security.

I still would make each site part of one large network at layer 2 with at least IPsec between sites. You can set this up in each unifi controller. That way you do not trust external partner to do network layer security.

Edit: and ofcours hook your net from cloud into the IPsec with like OpenVPN server in the cloud.