As you say, it's a big question. But one way to start is by integrating this _within your VPN_ such that network access + credentials alone are not enough. With Boundary you could do this by setting up firewalls on the end hosts to only allow ingress from Boundary worker nodes.

Eventually you can migrate towards Boundary nodes (or similar technologies) being the public ingress instead of a VPN endpoint.

(Edit: clarified that I meant firewalls on the end hosts, not on the VPN or elsewhere in the network.)