Well, your provider is right, the top most VIA header define the sender address where the replies are expected. Each hop in the path adds its own VIA at top till the request reaches the final destination. At final destination, the list of VIA headers reflects the reply path from top to bottom (i.e. first to last VIA header, where last via is the final user who sent the request and wants the reply from the destination). For example,
A send request to D via proxy B and C, then at D the VIA header list will look like this,
VIA: <address of C>
VIA: <address of B>
VIA: <address of A>
Therefore D will reply to A via C and B respectively. When C receives the reply from D, it will remove its VIA header and forward the reply to B with this VIA list,
VIA: <address of B>
VIA: <address of A>
The B does the same, it see that top most VIA its own address, so it deletes that and forward the reply to A with this VIA list,
VIA: <address of A>
When A receives replies it too removes topmost VIA (since it points to itself) and see there are no more VIA left, this means that reply has reached its final destination.
Of course there may be some other SIP routing headers/ elements which may change this behavior, e.g. Route, Record-Route, SIP Aliases, custom headers etc. etc.
You kamailio is configure incorrectly, it is not suppose to sent top most via to private ip unless your provider can reach you via private ip (e.g. through some vpn tunnel between you and your provider etc.).
So basically it seem your kamailio is miss configured. A good example and explanation of implementing load balancing can be found here,