Does it have to be fully automatic at the remote end? If so are you able to pick up emails in node-red?
You could send an email with the complete flow file attached and in node-red save that to the .node-red folder and then make it self-restart to pick up the new flow file.
However there are security implications of this that you need to consider. How do you prevent a malicious person sending an email with a malicious flow attached?
If some manual intervention can be required at the remote end then email the flow to the operator there and tell him to save the file to a pre-defined location, then in node-red watch that folder and when a new file appears automatically copy it to .node-red and self-restart.
I agree. While I can think of several potential ways to do it I would not want to do anything without full (written) permission of your client. Breaking their security has to be a no.