I agree with Derek's answer. However, there is something you need to consider as we have run into it in our organization. Portal is inside our firewall and on our intranet network. We have no issue accessing this from any computer connected to our network at our locations. However, if you're planning on using Portal on mobile devices (i.e. IOS, Android, tablets, or laptops) in the field you need to consider whether your VPN allows access to ArcGIS Online servers and map services. In our instance, our IT Security group will definitely not allow opening up our VPN tunneling to include the whole range of Esri's Amazon Cloud servers IP ranges. So therefore, we had to create any geocoding/locator services and basemaps served by our own internal ArcGIS Server which is allowed access through VPN.
I hope this helps.
Sincerely,
Paul Hardin
Senior GIS Specialist
Nashville Electric Service