There are a couple of ways to make this work. If you use a loopback interface you will want to assign it an unused IP address from the voice vlan with a 32 bit mask. You can have the tunnel 1 and private interface point to the loopback interface with the media-gateway ip loopback 1 command. If you do that, the SIP trunk configuration on the remote unit would need to point to the local loopback 1 interface IP address. The SIP server configured on the local phones (IP Phone Configs > select a phone and click edit > go to the Phone Settings tab) would also need to point to the local loopback 1 interface IP address. The public interface would not matter in this case unless a public SIP trunk is used. This approach is outlined in our SIP Networking Guide here:
Alternatively, you can omit the use of a loopback interface since the tunnel has its own IP address that can be used for media. If this method is used the tunnel 1 interface would be configured with the normal media-gateway ip primary command. The private interface would also be configured with the media-gateway ip primary command. The remote SIP trunk would need to point to the local tunnel 1 interface IP address (not the tunnel source address), and the SIP server for the local phones would need to be configured for the local voice vlan IP address.