OpenVPN with Redirect Gateway but user should have no access on internal LANs

[nicesense]

Hello,

I would like to configure an OpenVPN-Server on OPNsense which routes all traffic through the tunnel but the OpenVPN-User should NOT have access to the internal LANs.
You only can restrict the local networks while "Redirect Gateway" is not checked.
Is that possible? Currently I have on firewall settings the rule for OpenVPN to allow all. Are special firewall rules the soulution?
Has anybody an idea to configure this?

Martin