I suppose you could start at a really coarse level; it's pretty easy to have the VPN read the user's group from some central source and use that to decide what subnet(s) they get, and then you put ex. internal-use servers (say, file shares) on one subnet, customer application servers on another, and LOM consoles on a third.