Enforce VPN access to restricted area of our SaaS

Our Enterprise clients for our SaaS have sensitive data inside their account, and would like to make sure their team are only accessing their accounts on our platform via their existing VPN solutions.

How do we enforce this?

• IP whitelisting
• Allow them somehow to set up a VPC to avoid connections going onto the internet? Is this something like AWS PrivateLink?

This is where I quickly get out of my depth.

Ideally, I would be looking for a service where customers can set up the connection from their private network to their account on our SaaS without our intervention. Does such an option exist?

More detail on our setup

Our main SaaS app is a single instance of a Ruby on Rails app and Ruby on Rails API hosted on Heroku.

Users currently connect by logging into the website, where we authenticate via Auth0, which stores the user credentials in their session.

These SaaSes of yours don't really explain anything, it's like mentioning "I have a computer" all the time.

But judging from my experience, enforcing VPN access is mostly done by implementing IP filters or, if you use Web-applications, by implementing HTTP-based filters in the web servers, returing 403 status pages for clients that attempt to access the application from the outer world.

For nginx it would be something like that:

server {
    my protected.from.outer.world.site;
    listen 80;

    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    allow 172.16.0.0/12;
    deny all;

    location / {
        ...
    }
}

And IP filtering for non-HTTP-based applications and services.