Is a VPN the correct solution to my problem.

I have been asked to look into a VPN solution for our SMB. It would have up to 5 users accessing at a time but usually only 1 or 2. My question is this.....Is a VPN the right solution for us as the work required is mostly database driven?  We have a decent ISP but the speeds in this area are terrible (DSL 20mb D / 2mb U).  Obviously our upload speed is not the greatest and my understanding is that both upload/download speeds are crucial. We are currently using remote desktop but my concern is that we are leaving ourselves open for attack.

Suggestions and/or comments are welcome. Thanks in advance.