Should I use a VPN with MFA if I have multiple offices using client PII on cloud storage?

I have recently opened up multiple offices that provide customer support and provide space and data for sales representatives. My company has been gathering personal information with customer consent and storing it in a cloud space. I have already implemented a high-speed VPN that encrypts all data, however, I feel the need to add more layers of security to ensure we don't have any data breaches that could have been avoided. Will a multi-factor authentication be enough to ward off hackers? Or are there other data security measures that need to be taken?