You can connect the second firewall directly to the Internet. It is of the same type, so has the same capabilties and can protect itself and the network behind it in a similar way.
If you would like to put the firewall behind the other one, you need to allow the VPN protocols to pass the first firewall. Note, for VPN you may need a public IP address like your firewall for internet has (which usually does NAT).
In my business I have a main firewall and in addition a VPN gateway (of the same firewall type) which provides a lot of VPNs to partners. This VPN gateway is directly connected to the internet. But it's like a DMZ: to enter our internal LAN, it has to pass the main firewall.
So, instead of allowing tunneling through your first firewall, so your VPN user is directly inside your LAN, I would check if it's better to make the VPN directly to a firewall and use the second firewall to protect your internal LAN from the VPN subnets.