What you're asking about is the crux of many "network access protection" (NAP) products. Personally, I don't think that efforts like NAP really do anything useful, aside from "keeping honest computers honest".
Fundamentally, you're relying on the trustworthiness of the client computer to "act truthful" about what your NAP server computer asks it. There's no way for your server can "prove" that a remote computer is running a given program. You're really just taking the "good word" of that remote computer. That's the fatal flaw in the idea behind NAP-- trust is misplaced.
In terms of keeping your network secure, I'd argue that the principle of least privilege is the most important guiding principle. Be cognizent of and monitor "choke points" and attack vectors, keep OS's and applications updated, install only necessary software all computers (servers, clients, etc), and keep up with security bulletins.
NAP doesn't help if a machine gets a rootkit on it that can "convince" the local antivirus, etc, that it's not infected. I think there's more to be gained by minimizing attack surface and detecting attacks based on monitoring traffic and behavior.
In terms of VPN users, I'd be using a VPN that limited inbound protocols from clients to a known "allowed set"-- RPC-over-HTTP for Outlook clients (though you can do that w/o a VPN just as easily), RDP to get to fixed desktop computers or Terminal Server machines, WebDAV to get a file shares exported over HTTP, etc. Giving VPN clients unfettered layer 3 access to the network is certainly exposing a broad attack surface.
I'd consider using a VPN techology based in part on client devices authentication if you're going to allow more unfettered layer 3 access (and even if you're not, if you're concerned about unauthorized devices connecting to the VPN). Assuming your users don't have "Administrator" rights on their client computers and can't otherwise pry the certificate off of the device and install it on an arbitrary device, using something like L2TP/IPsec and computer-based authentication would go a long way toward preventing unauthorized devices from connecting to the VPN.