My network infrastructure is currently ISP Modem > TL-R600VPN > T1600G-28PS > LAN devices

I'm currently setting up my office VPN such that my devices can connect to a file server and remote monitoring system connected to my TP Link switch. The VPN is configured fine, but my issue is that I can basically have access to my whole LAN via the VPN connection, which I'd like to restrict.

Is there any way of assigning VPN-connected devices to a VLAN such that I can restrict what devices the VPN connected device can connect to?

For what it's worth I've assigned the VPN devices a fixed IP range, so I'm looking for a function either on the router or switch where I can assign those IP addresses to a VPN along with the devices I want to access? Is this possible?

I've tried restricting IP ranges in the ACL, but that still seems to enable access to the router login page etc.