How to isolate a user from the network but not the Internet?

Question

Windows Server

There is a terminal server on win 2012 r2 (192.168.88.10), the user connects to it via VPN (Issued such ip 192.168.88.5), how to make the user not see the local network, but can access the Internet
In the mikrotik router, added a rule to the firewall so that he can only connect to the terminal server, but on the server he can already see the local network.
What is correct to register in the server firewall so that he could not see the local network?

Answer 1

Bring the server to the DMZ, or if the user does not have administrator rights, restrict access to the server through Windows Firewall.