I think it's always a good practice to enable access control in production MongoDB deployments. Even if your instances are accessible only within the VPN, what if a malicious script gains access to your system? If you enable auth you have another layer of security and that's always a good thing.