There is a possibility that someone could break into your network via a VPN slit tunnel, though with dial-in, that possibitlity is pretty remote. Broadband users are a concern.
With a full tunnel, there ISP-assigned IP is not accessible on the Internet once the VPN session is started, so that takes care of the above issue.
I would say make sure your users at least have a personal firewall installed on their remote stations to assist in keeping the bad guys out.