mouse
This isn't too hard, it just depends on what groups you put the users in. You can set one with access to certain IPs and ranges, along with routing their internet traffic through the VPN, you can set the others to NOT have access to local resources other than just the gateway and DNS servers that would need to connect through to the internet and that would stop them from hitting anything else on your local network.