[c-nsp] Any examples of decrypt-side VPN ACL's?

[David H]

Hi all, I've got a site to site vpn set up between an unknown device
on the remote end and a run of the mill 1811 router on our side.  I'm
looking for some examples of how to block access for devices on the
remote side to things the vpn makes visible on our side to them.  I
know the IP schema from the remote side, there's no nat going on, and
I of course know what I only need them having access to on our side
(basically windows remote desktop for a few of our ip addresses).
Very little vpn experience so I'm having difficulty figuring this out;
any pointers to sites with tutorials/examples?

Thanks!