I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm building the system on a LAMP stack which will run on a server in-house (with off site backups, etc).
This may be a [really] stupid question, but we want our system to be available to staff remotely, but an internet-facing system seems a little risky for something that will contain too much important data. Would it be more secure for me to configure the server to only be available locally, meaning users would need to be connected to our VPN to access it? If I did that, as well as things like limiting login attempts, multi-stage login etc, what other things do I need to be aware of?