A web server inside the office network which is accessed by staff internally and the internal DNS resolves web.company.com to the server's LAN IP.
Publicly, company.com nameservers belong to their party hosting company where the main company website is hosted and it does not have web.company.com record.
Now if the web.company.com should also be accessible from outside, it is okay to expose our LAN IP in the A record so that only staff with VPN can access; or should web.company.com resolve to the office network external address and use firewall to route to the LAN IP?
web.company.com. IN A 192.168.1.10
on the third party DNS, thus "exposing" the LAN IP.