Short answer: Yes! Implement security best practices in any application storing sensitive data, or capable of accessing other servers with sensitive data, regardless of it being public-facing or not.
It is an all too common practice for companies to invest in securing their perimeter only. This means that access from and even to the internet is highly restricted and secured, but within the internal network security is much more lax.
Hackers know this. Thus, they often try to get within the internal network and then conduct attacks to increase the scope of their access throughout the network. As a first step in an attack, hackers often have been successful in sending "beachhead" malware (meaning malware that lets them connect to one machine on an internal network to establish a foothold) via phishing attacks, web exploits and other means.
This is how breaches end up occurring -- e.g. the Anthem breach. Once inside their internal network, hackers found it easy to pull up databases with lots of private data since they were poorly secured. The assumption that "it's on the internal network -- it's safe" proved to be a grand folly in this instance.
In the end, you have to determine what you think the risk is of having your internal network accessed by a third party; and then how detrimental the compromise of that data will be. If it even makes you a little worried, I'd recommend implementing SQL injection and other exploit protections on your internal application.