best security practices for apps using OTA?

is there a way to secure the communication port with mutual certificates?
is the best practice peer to peer vpn?
currently we do IP whitelisting, but that is brittle due to the static IP issue.