Phil,
I've not yet come across a BT home hub install (I'm sure I will soon) so not sure what options it offers.
I guess as its the wireless access point, you need it to be on the Internal lan, but as its the Firewall/Router, it needs to be on the external site (as far as SME in server/gateway is concerned). Is that right?
As far as I'm aware, you can VPN into a server in server only mode. However, you would need to set up Port Forwarding on the BT Home Hub to allow PPTP trafic through to the SME server. I'm not sure if terminating the VPN in Server Only mode is any less secure that terminating it in Server-gateway mode, but you would have to be sure the BT Firewall was definately blocking everything but PPTP traffic to keep the SME server secured.
I'd hope that the Home Home would allow for Port Forwarding - and support pass-through VPN - but wouldn't be totally surprised if it didn't. You may want to double-check the documentation (if there was any supplied.)
Jon