I think they mean VPN as in WireGuard where each customer would have a separate private network to the service provider. This way the service wouldn't be exposed to the public Internet.

MTLS would do the job, but you still just need one compromised customer.