Do the employees need VPN access?

No, the employees do not need VPN access.
The app never communicates directly with the customer system.