SSH Tunnel advice for dummies please

Hi, my client uses an application that is a telnet server, and it is connected to by telnet clients that are hand-held barcode scanners running a VT100 terminal emulator. They use these in factories and warehouses to scan boxes as they move about.

The clients are located in various locations around the world, and the server is in NZ. They're not happy about the clear text going over the internet for obvious reasons.

So I have half an idea in my head to secure this system and hope if someone here can tell me if I'm on the right track: Setup a little SSH server in the remote building, that accepts the local telnet connections. These telnet connections are carried over the building wifi - can't really avoid that with the current scanners they have, but hopefully this wifi can be made secure.

The SSH server somehow maintains a secure tunnel to another SSH server within a network in Auckland office that then connects to the telnet server. So the bit that is outside the fence is encrypted SSH and the bits inside are clear text Telnet.

Is this how it works? Can they just download SSH and go?

TIA for any tips

JohnO