This cannot be done with the level of specificity that you require. The sticky wicket is this:
I'd like to forbid access to one of the shares
You cannot create rules that restrict access to a specific share based on IP address/subnet. You can restrict share access by computer account and standard Windows group permissions, but that doesn't help you unless the computers that are coming through the VPN are both domain joined and also never simultaneously show up on the local network (they'd be restricted from accessing the share wether they were coming through the VPN or on the LAN).
What you might need to do is separate that one share on to its own file server. From there, you can restrict access to the server as a whole based on subnets using Windows Firewall (or IPSec rules, but that's ugly and unnecessary).