ISO 27001 does not require Virtual Private Network (VPN) to be used, it does not even mention this technology.

Virtual Private Network (VPN) could be useful for implementing control A.8.12 Data leakage prevention, A.8.20 Networks security, and A.8.21 Security of network services - since this technology is not mandatory, you should assess whether to use it to implement these controls.