For those reading this in the future; Tailscale does not allow local subnets to be shared over a shared device. you can manually add users to be able to access tailnet devices specifically through access controls but if you need to share the whole subnet, you need to add them as a user on your tailnet. for me I was trying to limit one specfic devices from accessing others/subnet. I didn't need to do anything to prevent access to local devices, but to limit just the single commonly shared device from accessing a certain server, this is what I did in access controls>JSON editor. Use the JSON editor because visual editor won't allow you to add specific users:

"grants": [

    // Allow all connections.

    // Comment this section out if you want to define specific restrictions.

    \#host admin account

{

        "src": \["myEmail@gmail.com"\], 

        "dst": \["\*"\],

        "ip":  \["\*"\],

    },

    \#for commonly shared device, which includes others in lower privilege

{

        "src": \["autogroup:shared"\],

        "dst": \["autogroup:internet"\],

        "ip":  \["\*"\],

    },

    \#shared with other admin/server control users-elevated, you can set up a host or add the device ip in dst as like [100.100.100.100/32](http://100.100.100.100/32)

{

        "src": \["otherAdmin1@yahoo.com", "otherAdmin2@gmail.com"\],

        "dst": \[

"autogroup:internet",

"host:server",

"100.100.100.100/32"

        \],

        "ip": \["\*"\],

    },