Correct way to prioritize remote management?

Can someone please confirm the following is the correct procedure for prioritizing administrative access on overloaded devices?

1) 2x Bypass rules - 1 each for in and out to office IP address?
2) 2x QoS settings - 1 each for in and out to office IP address with highest priority?

Any other tips and suggestions on overloaded boxes from an administrative perspective? I'm already working to implement more hard-ass rulesets to limit abuse but am wanting to make sure the administrative rules are in fact, setup properly...

Thanks!