Site-to-Site restrict Site A from accessing something on Site B

[vinneo]

Site A:
Interfaces: WAN, LAN (10.1.0.0/24), VPN, OpenVPN
Client: 10.1.0.1/24;

Site B:
Interfaces: WAN, LAN (10.2.0.0/24), VPN, OpenVPN
Server: 10.2.0.1/24;

I want to block Client 10.1.0.1 from accessing Server 10.2.0.1, how can I do this without adding any firewall rules to Site A? My problem is I don't understand the difference between the default OpenVPN interface of pfsense, and the custom interface if you add the ovpnc1? I though traffic from Site A will arrive at Site B in the "VPN (ovpnc1)" interface and I can block it there but It goes straight to LAN.

[vinneo]

Update:
Okay, I got this far that firewall rules added to the default OpenVPN interface work (i.e. drop all traffic from client 10.1.0.1 on Site B firewall), but if I add the same rule to the ovpnc1 (VPN) interface nothing happens. What is the purpose of adding ovpnc1 if firewall rules applied to it don't work?