Start by reading this:

What is a VPN?
https://us.norton.com/internetsecuri...-is-a-vpn.html

In short, I don't think that you want to go that direction... It might help protect the users but not the company's server.

The Company could set their servers to ONLY allow connection from six very specific IP Addresses. They would have very tough passwords for that connects AND very restricted access to the sever. Or the server could be a machine that does nothing but receive the connections.... From there they have networked shortcuts to needed company programs.