You can do this on tailscale with their ACL. It is super flexible for nailing down exactly which users/devices can talk to what on your network.