the salesmen would be on the field on remote places, therefore I can't use LAN
Either the salesmen use a VPN to get access to a server on your LAN, or you need an internet-facing server.
In any case, you need a server. This might physically be a desktop machine, however, the server will require additional administration to be reachable: a stable IP address and probably a domain name. It should also not be turned off while people need to connect. For that reason – and because it would be a risky security architecture –, the server should not be identical with the desktop device of your boss.
Given that you already need a server, building a web app would be the simplest thing you can do, unless you already have experience and infrastructure for a different stack in place (e.g. if you are experienced with Access, you might be able to wrangle a working prototype out of that). Another contraindication for a web app would be if the salesmen will not have an internet connection while they use the app. Then, a desktop app with a local database would indeed be necessary. (Technically, progressive web apps can also provide this, but probably require more development effort.)
Even when the system's clients are desktop apps, you should probably implement a server using a REST API – not because this is particularly good, but simply because HTTP is well understood and has great tooling. Additionally, the security implications of REST APIs are fairly well understood, compared to RPC mechanisms.