If you're looking for top-notch security of the highest kind - air gapping is the only way to make this work. Unfortunately, having absolutely no connections to the outside world under any circumstances can be prohibitive, especially as developers like to copy and paste code snippets from documentation and so on.
Ultimately, this probably also means taking laptops off site becomes a no-go also.
Assuming you can't do that (because let's face it, it's quite an ask) - firstly, mobile workstations. Definitely go with the VPN option. Ensure all of the internet traffic via those laptops goes through the VPN. This way, your architecture and security requirements (firewall policies etc) are definitely enforced, and more importantly you don't expose anything but the VPN endpoint to the public internet.
Encrypt the laptop hard disks as a minimum. If the laptop is stolen whilst powered down, the source code should be secure for a reasonable amount of time. If the laptop is not powered down, or the attacker can observe the password entry, you haven't done anything but make their job slightly more difficult. LUKS is supported in both Ubuntu and CentOS to my knowledge - it uses cryptsetup and gives you a choice of decent algorithms and multi-slot passwords.
Hardware based disk encryption would be better, simply because it means your
/boot partition is not modifiable.
Virtual LANs for security receive mixed opinions. From the point of view of development, I'm expecting your team work with sudo, or root, access and as such would easily be able to reconfigure the VM software to allow their host access, should they wish. As mentioned in the blog post, VMs are used for cheap network segregation - which works when you can enforce the configuration. Here, it looks like a difficult sell.
That's not to say you can't use virtual machines, of course; I would simply carefully study exactly how hard it is for your developers to bypass.
One way I've seen this work successfully if you have a sufficiently fast network and patient developers is to use remote desktop to VMs available on the network - but not physically accessible to the developers themselves. You can even use full thin clients, rather than desktops that RDP. The thin client model also deals nicely with my next topic... physical security.
When I say physical security, I mean how hard is it for your developers to plug a USB stick in,
svn co and walk out with the lot? "Taking the code home" can happen this way, but you'll lose the lot if the USB stick is lost. Generally, there are two solutions available to you - epoxy resin and removing the various
hci.ko modules from the kernel - thereby making it not recognise USB at all. Unfortunately, this has the downside of disabling USB keyboards and mice, too.