The VPN isn’t a protection in ‘Repeater mode’.
The repeater means there is a connection between Client A and Client B. it is the same network.
You could setup the firewall via iptables or something like that. But maybe it is easier to set the Beryl in router mode and set a own network for Client B. Regarding Ng of your Idea from ‘compltely isolated’.
In Default, there is no route from Network A to Network B, the communication from Client A to Network B is not possible. But Client B can reach the Network A (as well as Client A) over the Beryl. This behaviour can be managed by much easier firewall rules.
‘Completely isolated’ would be a DMZ in your router. The Beryl only is able to act as client inside Network A, it can’t configure Network A.