I'm thinking that business hardware can be considered secure in a
private network behind a firewall, whereby all incoming/outgoing
connections are done via VPN.
This is an older concept in Information Security. It’s referred to as a boundary model. Some would say this is archaic. Modern forms of architecture are based in zero trust models.
I'm under the impression that this is in general sufficient for a
private network's safekeeping.
And that depends on MANY things. What type of data do you have? What types of threats are you protecting your data from? What are the risks to your data? What is the size of the company? What is it likely to lose if there is a data breach? BTW, don’t publicly answer the questions I asked...
I would handle personally identifiable information differently than I would handle company secrets. Is there medical information to consider in your network (like what Human Resources might access)? Is there scientific data that may be controlled in some way? Is there financial data? What are the legal requirements for what you are doing?
What I'm more worried about though, are employee PCs.
It sounds like you want to allow business PC’s, but prevent employee PC’s from connecting to the network.
I'm currently considering a VNC client that connects through an ssh tunnel (while also connected to the vpn).
So you’re having a system connect to the business network using a VPN
Then you’ll have VNC access through SSH. How does that prevent someone at home from installing a VPN client on their home PC, installing a VNC client on their home PC, installing an SSH client on their home PC and...
Turning on the VPN client and logging in using it, then turning on the SSH client, building the SSH tunnel, and then running the VNC client across the SSH tunnel?
If your answer is certificates, it doesn’t take long to find out where certificates are stored, export them, and send them to an email address or dump them on an external drive.
I'm not really sure this is sufficient though. Will a VPN protect the
ssh connection from malice?
An SSH connection can be used on its own as a VPN. It does the same job (encrypts traffic end to end). Putting one inside a VPN is essentially a VPN inside a VPN.
Do I need an employee-pc firewall in addition to VPN to keep it
A firewall doesn’t “hide” VPN traffic.
Do I need to even care who can see the ssh tunnel if its accessed by
Well, that depends. Putting the SSH tunnel inside the VPN tunnel allows the traffic to be encrypted once it exits the VPN tunnel inside the business network. This means that people inside the business network (sitting between the VPN entry point and whatever server you are having people SSH to, you have to have an end point for SSH) will only see encrypted traffic. Without SSH (in the days of TELNET) logins and passwords were sent in clear text. SSH is meant to mitigate this vulnerability.
These are questions I have gut feelings about, but can't answer with
You’ve asked a LOT of security questions. What you don’t have is something that deals with the vulnerability you are concerned about. There are many ways to handle this. Some require multiple steps. You really are in over your head at the moment. I say this with almost 3 decades of experience (check other questions I’ve answered on this board), education, and certifications.
What should you do? Recommend bringing in a contractor. Someone you can work with and learn from while you are putting security in place. Then go take some classes. There are LOTS of free videos on YouTube on Security basics. They are a good place to start as well.
Let me know if you have further questions.