VNC will be safe enough, though mostly due to obscurity. Much better is to run SSH (as already suggested), and then use it's "port redirection" capability to run VNC inside it (without VNC even being aware that it's happening.. Cool!).

Cheers