I’ve done something similar, though not with openwrt. There may be a decent way to do this on the firewall, but I ended up using the ACLs available from the Tailscale console.
I removed the default allow all rule. I made a group called admins that can access everything and then added a set of routes that everyone on the tail net could access.
I’ve only recently set this up, but initial testing seems to have this working as hoped.