VPN is one layer. Filtering all port 80, only permitting TLS, and aggressively paring down your trusted root cert list can effectively mitigate the MITM threat.