As the information being protected becomes increasingly sensitive, you need additional layers of protection. Those layers do not necessarily have to intrude on the user. Start with a simple administrative technique called compartmentalization. Compartmentalization means arranging your network's storage areas into security domains. Public information is isolated from private information and confidential information is the most isolated of all.
Isolation means at least separate volumes, but separate servers are better if that is practical.
Ensure that external access meets all of the usual access-control criteria for need to know. Unless there is a specific reason to make sensitive information available, don't. If you must, add extra access controls and isolate it to only those users who must access it. The next likely layer of protection is the access controls that come with remote access programs. These programs generally perform some sort of proprietary handshake routine with the network gateway that establishes the connection attempt is legitimate.