To ensure that an Azure-based service, like a database, is accessible only from within a virtual network and not over the internet, a private endpoint should be used. The private endpoint provides a secure connection to services by assigning a private IP address from the virtual network to the service, thereby ensuring that access to the service is limited to network communications originating from within the virtual network. A public endpoint or public IP address, on the other hand, would make the service accessible via the internet, which would not be secure for sensitive data. An Azure VPN Gateway creates a secure tunnel between different networks but does not restrict the public accessibility of services.