What other business implemented controls could mitigate the risk posed by ‘ unsupervised’ web-surfing policy—explain why/how?

Can VPN and FTP ‘co-exist’ or are they essentially providing the same service ( if co-existence suggested, this should show in the Visio Diagram)? Does this proposed business VPN allow business staff who web-surf from home via the business VPN to circumvent the new Australian metadata laws–explain your answer. What other business implemented controls could mitigate the risk posed by ‘ unsupervised’ web-surfing policy—explain why/how?