PCI, HIPAA and GDPR all would agree that most of your users most of the time should not have any access to sensitive data. It's reasonable to have users VPN'ing

PCI, HIPAA and GDPR all would agree that most of your users most of the time should not have any access to sensitive data. It's reasonable to have users VPN'ing in only when/if they need access to a specific system storing sensitive data, and even then, have only that access happen through that VPN, there's no need to pass their Zoom conference through the same VPN, and it would be a benefit (or even a requirement) to ensure that the sensitive data is separate from their Zoom conference. E.g. a remote desktop access that prohibits copy/pasting and file exchange so that you can't accidentally get the sensitive data to your email or chat environment.