In Pi

Set up the VNC server to accept connection from 127.0.0.1 only. This IP address always refer to the computer (in this case the Pi) itself. No device other than the Pi can access the VNC server.

Set up ssh server. For maximum security enable public key based login in ssh and disable password based login.

In Laptop

Set up ssh tunneling to the Pi in your VNC client software like Remmina.

Bonus Point

If you don't need to access the internet from both the Pi and the laptop, disable WiFi in both and use an Ethernet cable to connect the two.

Since neither the Pi nor the laptop has a DHCP server installed, you will need to assign static IP addresses to both of them.

Hope this helps