You have a network that you want to keep isolated, but you're planning to reduce that level of isolation a little bit. I think the most important question you need to ask yourself at this juncture is: "Isolated from what?"
Let's say that you run an Internet-exposed VPN service that leads into this otherwise isolated network. That is likely to be a well-written piece of software that has seen tons of analysis. You can implement it with extensive safeguards including network filters, mandatory access control, alarms and audit trails. It is not extremely likely, in and of itself, to reduce your level of isolation.
Now let's look at the bigger picture. Who or what would be connecting to this hypothetical VPN? I would hazard that the answer is a multi-purpose workstation that runs a plethora of software. It browses the web, it opens email attachments, it runs software updates over the network. This machine is your adversary's best friend, a machine that is basically impossible to keep secure. I would bet that it has even been physically attached to the "isolated" network on occasion in the past. I would offer that it's this beast from which you desire to isolate your sensitive network.
Here's my point: Identify the threats you want to isolate from, and do it. Those threats are mostly Internet-bound attacks on the workstation(s) which will be used to remotely troubleshoot the sensitive network. I recommend a dedicated collection of notebook computers that are as minimal and hardened as your VPN server, to serve as the only authorized VPN clients.
I am amazed that many of the other answers think the problem is solved by secret knocks, keeping the remote access service disabled when not in use, etc. All of these tricks will be defeated the next time your admin opens a malicious PDF on his VPN client machine.