@SebastianH I'm not sure what other equipment you have.  I am also using a 7206 (but i also have a TL-SG2428P) and I used a switch ACL to block other VLANs from accessing the management VLAN.

I have it disabled right now though since I am still setting everything up (and migrating to a new controller).  I am not sure if I enable it if it will break my VPN access.  

Either way though, you should be able to use the switch ACL if your topology supports it.

Hi  @muzicman0 

Thank you for your advice. I also have ACLs configured to block inter VLAN traffic. This is working fine.

But it's still possible to access the Router Login Page, due to the fact that its not possible to limit the management to one specific VLAN on the Router.

It's still possible to access the page from every VLAN by using the internal gateway IP of the interface VLAN.

  @SebastianH I see.  I can hit the login page, but if I log in, access is denied (since I am using a Controller).  This is adequate for my needs, but i understand why it may not be in other cases.

Hi  @Virgo 
I was just trying to implement your suggested solution. 
But I don't have the possibility to choose a service type when I create a gateway ACL.