First, set up a private network between the virtual machines. This is called "host-only" by VirtualBox. The result is that the host and each of the virtual machines gets a private IP in the same subnet.
Now set up a VPN server on the host to allow your users access to this private network. Here you have two options:
- Use a Layer 2 (TAP, Ethernet) VPN, and on the server, bridge the virtual VPN's TAP interface with VirtualBox's host-only interface. This will give the users direct Ethernet-level access, equivalent to being attached directly into the private network, like the guest VMs. Each user is given a private IP address in the same subnet as the "host-only" network.
You should only use this approach if you need Layer 2 access to the VMs. It's insecure, as it allows users to issue Layer 2 attacks (see ARP poisoning). Note that Layer 2 access is needed if you want Windows' simple file sharing with automatic detection of hosts.
- Use a Layer 3 (TUN, IP) VPN. Use a separate (private) subnet for the VPN network (clients, server's TUN interface). Make the host forward packets between the VPN network and the "host-only" network. Users also need a route to the "host-only" network through the virtual VPN TUN interface, and the VMs will need a route to the VPN network through the emulated interfaces of the "host-only" network.
As far as VPN software goes, there are a lot of choices. OpenVPN can do both Layer 2 and Layer 3. For Layer 2, you can also use my own software BadVPN.
Note that Windows is not a good choice for a host OS as far as networking capabilities are concerned. Linux is far more powerful in this respect.