Export Network One Direction?

My OpenVPN setup is as follows:

22 store locations with UT servers connected to a UT server at the main office as OpenVPN clients. My home UT server is also connected to the main office as an OpenVPN client. Currently, all locations can see devices at all other locations. I would like to make this a one-way street, where the main office can see all devices at the stores, and I can see all devices at the main office and the stores from home, but stores cannot see devices at the other stores or my home network.

I am guessing I can accomplish this with either the firewall or how I export networks, but I'm unsure of how to proceed, and since these are live systems, I need to keep testing to a minimum.

Any advice would be greatly appreciated. As usual, a big kudos to the Untangle people for a fantastic product that makes my job easy. Keep up the great work.

Thanks,
Riff