Asumptions: The interface between your internal network and the external network currently provides the desired level of assurance. The external server is low assurance and may be compromised.
Goals: Maintain the current level of assurance at the connection between the internal and external networks. Add a new interface to the connection without setting up a DMZ.
Unfortunatly the answer depends on your present architecture, but I will try to guess at what you might have. I am assuming that you have a router connected to a single bastion server (combo firewall, IDS, NAT, proxy, etc) and that the other side of the bastion server is your internal network. You want to preserve the existing security of your current setup, so I think modifying the architecture as little as possible is prudent.
Note: this is a rough sketch, you should do thorough analysis and planning before implementing a solution.
Buy a new machine capable of supporting two physically separate ethernet interfaces. What I mean is that if the motherboard has onboard ethernet then you need a PCI or PCI Express ethernet card. If the motherboard has no onboard ethernet then you need two PCI or PCI Express Ethernet cards.
If your bastion host can support a new physically separate Ethernet card, then get a new card for your bastion server.
If you have a new Ethernet card for your bastion server then connect one of the ethernet ports on the new machine to the new card on the bastion server. Otherwise just connect the new machine to any available port on the bastion server.
Pick an internal machine as your internal contact point for the new machine. If possible install new new physically separate ethernet card on the internal contact point. Install VPN software on the new machine and the internal contact point. Configure the bastion server to only accept incoming (do you need outgoing also?) packets of the correct type from the MAC address of the new machine. If the bastion server has a new Ethernet card, configure the bastion server to only accept packets from the new machine on the new physical interface. Configure the firewall on the internal machin to only accept incoming VPN packets from the new machine (if possible, on the new Ethernet interface). Configure the new machine to accept the appropriate packets from the internet. Connect the other physically separate ethernet interface to the router that is connected to the internet. Check the audit logs regularly, keep good backups, etc.
This is not too expensive. One PC (does not have to be server level), three ethernet cards, some cabling, some software, and a lot of configuration. The nice part is that you now have a machine you have physical access to, which is connected to the internet and requires minimal changes to the network architecture to accomidate it. The bad part is this will take a lot of configuration and probably some energetic convincing of the owners of the bastion host and the internal contact machine.