Do I need a VPN for my application to connect to SQL PaaS?

No, the SQL database port is exposed like any SQL server on-Premises or hosted. The firewall settings and IP filter provides a layer of protection. Refer to the resource here to configure Authentication and firewall settings. 

Applications can use the ODBC connection string that can be retrieved from the Azure portal for the SQL DB. Check here for the step by step process to obtain the connection string.