It's kind of a pain in the ass but a solution is to set these devices all in their own L2/L3 network segment with separate routing (via a different VPN) out to public.