How to securely connect app and database servers?
I'm not sure why you've been told that VPN technologies are not generally used. It is correct that they have a performance cost but then again, so does everything! For the amount of data typically moving between an application server and its database server, the CPU overhead of TLS should be negligible, especially on the database server. If that is not the case then look at purchasing SSL-offloading hardware.

My preference is two network cards in the application server. The connection between it and the database server goes over a different network than client traffic.

If a separate network is not possible then my preference is TLS combined with configuring the firewall on the database server to only allow incoming connections from a small number of computers - the application server (obviously), administrative workstations, operations management servers, etc.