Let's say we have a private network that is inaccessible without VPN. 

Now we want an external service to communicate (e.g. HTTP/AMQP) with the service from our network. As stated in title, it is less secure than hosts inside the network (no regular security checks, etc).

Is there any difference to provide VPN credentials or just adding this service IPs to the whitelist? I mean if external service would be compromised, VPN will not help (I guess).

What is considered a good practice in this scenario?