1:1 NAT for single IP?

[sgw]

We want to set up the following:

there will be an IPSEC VPN to a customer site which should be "one way only": we want to access one or a few IPs there, but they shouldn't be able to access our LAN. This is configurable via firewall rules, I tested that.

Additionally it is requested to "map" their server's IP(s) into our LAN: is it possible to somehow NAT/rewrite the target IP into a LAN IP so that we can access their server by using this mapped IP and pfsense rewrites that and routes it via IPSEC? (we have to hide that remote LAN in a way …)

I am quite sure that this is possible but I am somehow unsure how to google/search some example.

maybe someone understands my issue and has a pointer or two?
thanks, regards, Stefan

EDIT: right now I solved it via a virtual IP on the LAN-NIC and a portforwarding to the IP in the customer LAN. But maybe there are more elegant solutions.