Whether a VPN is necessary in this scenario would largely depend on the nature of the traffic between the worker and the web server and whether you're worried about Man-In-The-Middle(MITM) attacks.
A VPN could add two potential benefits to your security here. Firstly it should encrypt the data between the endpoints. This is obviously a security benefit if the traffic between the two endpoints is unencrypted by default (e.g. over HTTP). However if the data is already encrypted, then there may be a limited benefit here.
The other benefit could be authentication of the endpoints. At the moment you're restricting by source IP address using a firewall, but there are always potential risks (over an untrusted network like the Internet) that someone could place themselves "between" the endpoints as a Man-In-The-Middle. A proprerly configured VPN should include authentication of the endpoints which should preclude this kind of attack. However it could be that the application traffic already handles this (e.g. HTTPS with trusted certificates) so the VPN might not add much.
So there are potential benefits, depending on the nature of the application traffic.