How should I setup a server (Windows Server 2008 R2) such that FTP access is possible over a normal Internet connection, but HTTP access is only possible when connected to the company VPN?
This is simple, but there are a few ways to go around it. The way I would do it:
If this server is behind a router (but with NAT) and it has the VPN endpoint the other side of the router/same network as the server, you simply need to forward the FTP ports you use from the router to the server, but just don't forward port 80 / the HTTP port you use.
If you want to be a bit more secure and have it only accessible via VPN and not internal network, then use IP restrictions on the HTTP server to only allow access from your VPN DHCP pool / Static reserved addresses.