When you connect as a VPN user to the VPN server, you have access to all internal networks (LAN, X1, X2, X3, etc) as well as the Internet.
But you can specify a user as a guest. In that case, he can only connect to the Internet, not the internal networks. In an upcoming release we’ll add the option to choose which network(s) a VPN user can have access to.