Security in layers. You should keep your dev environment private but also not paste credentials into a networked textbox.

"making things not available to the outside world"

Has been proven repeatedly to not reliable work.

And security model must assume a attacker somehow got access to the VPN it whatever you use for isolation.

If not it's not a reliable security model.