A VPN is a Virtual Private Network whereby traffic flows within an encrypted tunnel across networks. Often this is used to route Internet traffic from an arbitrary client, via a VPN server outside its network onto the Internet. This has the advantage of protecting client traffic in its local network, until it reaches the first router on the Internet. Traffic from that client coming from the VPN server to the destination is no different than whether the client would have connected directly. This acts at the operating system level, at the TCP/IP network stack. A VPN isn't really a tool designed to protect against a specific attack, it is instead a means to securely tunnel a connection across untrusted segments.
Certificate pinning is a technique whereby a developer ensures that a piece of code refuses to connect to a TLS server unless it presents the (or one of) pinned certificate. This acts at the software level, be it a mobile app or a browser or a desktop binary application. This is used to protect against attacks that somehow or emulate the server-side endpoint by leveraging TLS features.
These are different tools designed for different purposes.
An attack that certificate pinning would mitigate (but isn't implemented) would still be possible if the client connected via a VPN. Conversely, a client app with certificate pinning would have a level of reassurance of integrity and data confidentiality even when connecting via an untrusted network.
In your particular case, considering that your app is internal only, you can argue that your internal network is totally trusted (!) and that your VPN provides sufficient control for your requirements. This isn't entirely unreasonable. As long as you understand that these two features are designed for different purposes and mitigate different classes of attacks.
