By signing the contract, you agreed that your line will use CGNAT.
Anyhow I don't really understand (and I think you have no plan at all) why CGNAT imposes a security risk to your companies network. As all the traffic in the VPN is encrypted, nobody else than you is able to decrypt the traffic and thus the use of CGNAT doesn't impose any security risks to the VPN connection. Same applies in case you'd connect from a mobile network - there it's also common that the providers use CGNAT and not public IP addresses for the devices registered in the network.
Even with your Telekom contract, your company would have needed to enable all of the public IP ranges of Telekom in order to allow you to set up a connection - as it is not said that you always will stay at the same IP address - as Telekom doesn't offer static IP addresses for end customers.
And by the way: If the VPN is correctly set up, you don't need any open ports or "punchend holes" in the firewall on your side - as all your traffic is outgoing traffic and thus the NAT does not need to open any ports for incoming traffic (despite the one that is bound to the outgoing connection - but that's standard).
For your company, it is absolutely no difference between allowing the CGNAT servers from Vodafone -or- all public IP addresses from Telekom - as you don't have static IPs in either case and thus may appear from any possible IP addresses from the customer range of your ISP.
And the only way to get a static IPv4 - which seems to be what you want in case your companies firewall will be exclusively opened for just this only IPv4 address and not whole ranges (needed for dynamic IPv4s of Telekom customer contracts) - is to switch to a Business contract. Same also applies to the Telekom - there you also only get a static IPv4 in case you subscribe to a business contract.
