Yeah, option 1 is what I do for my own remote machine.

  0 * * * * /sbin/pfctl -f /etc/pf.conf.knowngood

If needed, copy then edit the known good file, load rules temporarily, make sure everything works. Make sure the tests have enough time to run (that is: don't reload every minute, but every <long enough duration here>). If all is OK, then backup the old known good file, move the new one in place.