Seeking help with industrial network security issue

Sorry if this is against the rules or not the place to ask, let me know and I will remove.

I am not a networking guy but need to implement the requirements below. Any help is appreciated!!

Topology: https://imgur.com/a/mniDv5a

Requirement:

• Remote connection must be able to access devices A,B,C
• Remote connection may not access Network A
• Network A must be able to access device A. Don't care if it can also access devices B, C.

​

I can change IPs, subnets, have access to a layer 2 switch and and a layer 3 router, but don't know where to start on coming up with a clean solution for this. VLAN with NAT? Simply subnetting?

​

Thank you in advance!!