Your question (as stated by Joshua) isn't necessarily a security concern. But part of it might be, so here is some background information you might want to think about:
If you create a webapplication and create it with security in mind, your two most likely risks might be: 1) Leakage of data (e.g. from your database) and 2) compromization of the server and (afterwards) an attack from that point towards your clients or third parties. If your webapplication is using proper authentication and all the well known security mechanisms it may very well be sufficient and you could just put it on the internet (that's what quite a lot of sites do ;). You could as well put it on an internal vpn and decrease the attack surface in that way. An attacker would have to gain access to the vpn, before being able to attack the server itself. This might increase attack complexity but also increases the complexity of your infrastructure. Since both can be equally safe and unsafe this is not really a security question.