Yes, you can have VPN endpoints to your VPC, where the other end is in whatever external network you want. And if you don't want any external communication at

Yes, you can have VPN endpoints to your VPC, where the other end is in whatever external network you want. And if you don't want any external communication at all (barring your VPN), just remove the 'IGW' from your VPC (or make a new VPC without one). Or modify the VPC's routing tables. Or don't assign any public IPs to anything in the VPC. Or probably a few other methods :)