In the point of view of security, what are the difference between a "cipher tunnel" by ssl or by vpn? The scenario is: One server web that provides a service to few (known) people. Now the authentication is based on iis' basic authentication (over ssl), and a kerberos system. It will possible use a VPN to authenticate on a web service, and use it instead ssl+kerberos? it will a gain on the security point of view?
Cryptic version: it depends. ;)
There are some very insecure ways to deploy both SSL (v2, md5, renegotiation exploits) and VPN (some VPN solutions use deeply flawed crypto algorithms such as RC4).
The security level of modern, well-configured implementations of both technologies is roughly comparable (and quite good).
To the other aspect of your question - SSL is probably the best solution for you; being connected to VPN and hitting an unencrypted page will lose some of the advantages of SSL (notably, server authentication) and will leave your requests in plaintext in between where the VPN terminates and the web server.
If the service is limited to a known set of users then VPN and a firewall set is going to be easy enough to set up.
You could even just use fire-walling here if you know the users IP addresses are static (internal corporate network). All you do is add rules to allow the known hosts and then deny all other.
If the users are coming from outside on dynamic addresses then a VPN plus a firewall will work well here.
You can employ SSL on top of all this too to add another layer of security which will not be inconvenient to your users as it is transparent and doesn't require anything from them.