I am curious to know why you have opted to run mt-daapd at work, rather than at home. Nevertheless, there are a couple of ways to do what you desire — both require a relay system of some sort on your home LAN.
In either case (unless I am missing an alternative), you will need a machine on your home LAN which is capable of acting as an mDNS beacon relay. (Basically, this entails a system with Howl, Apple’s mDNSPosix package or the like capable of proxy service installed. Once configured, the tunnel can be created by one of two methods.
Initiate the tunnel from your relay system to the machine at your employer. Once established, create the mDNS beacon with local subnet broadcast. The SoundBridge should be able to recognize the share broadcast and make use of it for play. I say should for this will work when dealing with other, software-based clients on your home subnet (e.g. iTunes), but I do not have a Roku hardware client and cannot attest to its robustness in this regard.
The other option is to create a reverse SSH tunnel from your work machine back to your home subnet. Proceed as described above from that point. This method is a little more cumbersome and I am not sure why one would need to do it this way, but I offer it for completeness. (One reason might be if your employer allows outbound SSH connections, but not those inbound.)
Either way it is accomplished, you will need to establish a beacon relay on your home LAN to rebroadcast the share served by mt-daapd at that location.
To completely avoid any potential SoundBridge issues, it would be easiest to move your music library from work to home and then follow the instructions at the documentation node for an SSH tunnel and make use of iTunes at work.
–Herman