Hi,
You should have at least 3 VM’s for the production use case. - Replica sets should always have an odd number of members. This ensures that elections will proceed smoothly. There is a good MongoDB tutorial that describes how to create a three-member replica set with access control.
You can also think about x.509 Certificates