Best? Probably an infrastructure VPN across databases. Have you database listen on the MPLS link and limit access to the service based on IP addresses and strong authentication.

Cheapest? SSH tunnel or openvpn point to point link.

Vpn, gre, whatever flavour you like. That's for replication between sites though. Internally there's nothing wrong with direct connection.