I am a Deployment Advisor at Tableau and I would like to answer this question in a step by step guide through this process.
Step 1. You save the TDE file on the VM system behind the firewall of the VPN
Step 2. You publish the TDE to your Tableau Online site
Step 3. You schedule the refresh using the Tableau Data Extract Command-Line Utility or (tabcmd)
Step 4. The scheduled time arrives and the utility runs your command, which goes out to your file location of the saved TDE file
Step 5. The utility then posts that copy to your Online site, overwriting the original published version
Point A is the connection that you make to your companies database and that connection information such as server IP or name is saved inside the TDE file. This contains the connection string and any embedded credentials you enter when you create and save the extract.
Point B is publishing that file as an extracted Data Source to your Tableau Online site
Point C is where you use the tabcmd utility to connect to the published extract of the data source, which contains the connection information to your data source
Point D is when the utility uses the file location that has been saved inside of your published extract to grab the file and re-post it to Tableau Online where it overwrites the original data extract
Please let me know if you need any more detail or have any further questions.