I have a SQL Server placed in DMZ and I want to give access to internal users (and VPN clients) to use SSMS to remotely connect to it via port 1433 so server will accept the connection only form defined IP sources over this port, is it a safe approach for a production server?
First let's answer your initial question then your follow up question.
I would go further and: change the SQL Server port to a non standard one, turning off the SQL browser service, renaming SA, turning on the firewall on the local machine not to accept any connections on the SQL Server port outside of your internal IPs, and have all of your traffic hit the web server which serves as a secured abstraction layer for outside connections.
Follow up question: How about HyperV and setup one server for SQL internally and a second one for the web server in the DMZ? Why does the web server need to be in the DMZ? Are you able to just forward all 80/8080/443/etc. ports over to that web server?
BTW, since you have both on 1 machine, have you set 'max memory to use' options in SQL Server and 'lock pages in memory' so IIS doesn't steal precious RAM?