Never trust the network in any circumstance. If you start from that basis then life becomes easier.

Google has a good approach to this: https://cloud.google.com/beyondcorp

EDIT:

I’d like to add a tangential rant about companies still using shit like IP AllowLists and VPNs. They’re just implementing eggshell security.