Exactly what kind of access are you trying to limit? As an example, do you have a server in each office, but only want Office A's servers (or printers, cameras, etc) to be accessible locally? Or is there more granularity needed?
You can restrict destination addresses on the tunnel, but sometimes this works better at the application layer rather than at the firewall level.