How to prevent that users connect some certain IP address over VPN

Hi   I 've set up a network access profile to people connect local network over on APM. But there are some certain IP addresses in our lan which I do not want to people connect them over VPN. How ...