Is the reason for this explanation that the VPN connecting machine is not under PCI DSS scope, so it's treated as unsecure/public access,
or does VPN eliminate that notion?
First of all, if you have a VPN, you must have 2-factor authentication to make it PCI compliant. You didn't mention that, so I figured it should be made explicit.
Once you have your 2-factor VPN, the question of whether you can access your CDE (in-scope) comes next. You can do it, or not do it. If you do it, then you're either putting your VPN network in-scope, or you're not, depending upon the segregating controls (DSS 3.1 p11):
To be considered out of scope for PCI DSS, a system component must
be properly isolated (segmented) from the CDE, such that even if the
out-of-scope system component was compromised it could not impact the
security of the CDE.
So - made-up examples here - if your users can access a web portal in the CDE in-scope network via the VPN, and that portal allows them to manage payments but not to see decrypted PAN data, then you're probably not putting your VPN devices in scope.
On the other hand, if your VPN users can run a database query tool and export decrypted PAN data from the CDE in-scope database to their VPN host, then that VPN network is not properly segregated and it is in-scope.
But, I'm getting fuzzy responses from other colleagues working on
these issues. They think access from VPN to INT should be forbidden,
and the only way to connect to INT servers should be by connecting to
VPN, then ssh-ing to one of the DMZ servers and then hopping into INT.
I can't find any such notion in PCI DSS docs...
This is all very much a matter of QSA judgement, but my experience suggests that any interactions between the VPN network and CDE in-scope networks should be mediated by proxies or other application layer control points in order to keep the VPN network out of scope. Whether or not simple island-hopping as you describe is sufficient or not is up to the QSA.
The "docs" talk around these issues without clearly addressing it. The Open PCI Scoping Toolkit was an attempt to regularize the approach that entities and QSAs took to designing, describing, and auditing networks; a way to compensate for that lack in the DSS itself. It's not a standard, but it can be very useful to read through and if your QSA respects it (some do, some don't) then it can ease the difficulties working through network scope boundaries with them.