My company had a policy that any infrastructure should be accessed through our internally managed VPN.

This isn't particularly common, but it's not uncommon either.