First, are you wanting to publish your website to the public or is it just for your use? If its just for you, your upload is fine. For public consumption, forget it on that bandwidth.
Dont put the website directly on your public IP, leave it behind your firewall (airport extreme) and setup a forwarded port. You can add a little security by using a non standard port that forwards to either port 80 on your Mac hosting the website, or setup the Mac to use a different port than 80 for the Apache service which helps to prevent any intruders finding the web server on an expected port. If you use a non standard port and you want to surf to your site, you would add the port number as
http://mysite.com:18776 for example.
I dont think you necessarily need to setup a VPN for the task you have outlined unless you expect to run other services from your internal network. Its just overhead and you dont want that.
There's a whole lot you can do and it comes down to how much you want to configure. i.e. how secure do you want it, how much access, etc