You don't need to expose CosmosDb over the internet, CosmosDb supports Private Link. Resources mapped to Private Link are also accessible on-premises over private peering through VPN or Azure ExpressRoute.
For leveraging ODBC to connect to the CosmosDb, see this guide https://learn.microsoft.com/en-us/azure/cosmos-db/nosql/odbc-driver#install-the-odbc-driver-and-connect-to-your-database