Set up the VNC server to accept connection from
127.0.0.1 only. This IP address always refer to the computer (in this case the Pi) itself. No device other than the Pi can access the VNC server.
ssh server. For maximum security enable public key based login in
ssh and disable password based login.
ssh tunneling to the Pi in your VNC client software like Remmina.
See https://askubuntu.com/questions/1206883/how-to-prevent-x11vnc-attacks-attempts-to-unauthorized-logins for details.
If you don't need to access the internet from both the Pi and the laptop, disable WiFi in both and use an Ethernet cable to connect the two.
Since neither the Pi nor the laptop has a DHCP server installed, you will need to assign static IP addresses to both of them.
Hope this helps