What is the best method to close off the backend?

If you know the sub-net of your VPN you could restrict access to /wp-admin via .htaccess using standard Apache rules.

<Directory /var/www/wp-admin/>
  Order deny,allow
  Allow from 192.168.1.0/24
  Allow from 127
</Directory>

Obviously you’d need to adjust the directory and IP address subnet to suit your needs.

To restrict access to a specific file:

<Files _FILE_.php>
    Order allow,deny
    Deny from all
    Allow from 127.0.0.1
</Files>

Again you can use a sub-net mask to suit your VPN.