IPsec restrict a specific mobile client to access the LAN

[Stefan Milev]

Hi gents,
just a quick question. Is there a way to set up an IPsec tunnel to restrict access just for one mobile client to not be able to access the LAN network?
Also, is there a way to assign a static IP to a client?
What I have at the moment is an IPsec EAP-MSChapv2 working perfectly but I want to give access to a client that should not have access to my LAN side.
I have done this with OpenVPN but I can't find a way to do it with IPsec.