How to prevent that users connect some certain IP address over VPN

Hi

I 've set up a network access profile to people connect local network over on APM. But there are some certain IP addresses in our lan which I do not want to people connect them over VPN. How can I prevent VPN users to connect those IP addresses ?