The TCP Port for a VPN is not what's meant as a remote server administration port. The rationale listed for 5.2 clear identifies these ports as 22 or 3389 (ssh
or remote desktop protocol).
Public access to remote server administration ports, such as 22 and 3389, increases resource attack surface and unnecessarily raises the risk of resource compromise.
In other words, ports that allow a user to login remotely to administer the server.
Here's an example of how a TrendMicro tool identifies and remediates 5.1:
Check your Amazon VPC Network Access Control Lists (NACLs) for inbound/ingress rules that allow unrestricted traffic (i.e. 0.0.0.0/0) on TCP ports 22 (SSH) and 3389 (RDP) and limit access to trusted IP addresses or IP ranges only in order to implement the Principle of Least Privilege (POLP) and reduce the attack surface at the subnet level. TCP port 22 (Secure Shell – SSH) is used for secure remote login by connecting an SSH client application with an SSH server. TCP port 3389 (Remote Desktop Protocol – RDP) is used for secure remote GUI login to Windows VM instances by connecting an RDP client application with an RDP server.
That being said, if you are able to limit access to your VPN server you should (this isn't always possible). It decreases the attack surface. Decreasing your attack surface is never a bad thing.
Reference
TrendMicro KB ACL Inbound Access on Admin Ports