Limiting outside access is not "security through obscurity". That would be something more like "we have a VPN server that gives you full internal access that do

Limiting outside access is not "security through obscurity". That would be something more like "we have a VPN server that gives you full internal access that doesn't even have a password, but no one is going to figure out that we are running it on a non-default port".