RBR50 - VPN assigns IP address to different subnet

Well I tried the 255.255.0.0 subnet. rebooted/ refreshed the dynamic dns and vpn settings/ rebooted/ redownloaded the vpn file for ios.... no joy. 

Without changing the internal 192.168.88.x address (only the subnetmask to 255.255.0.0) Openvpn for ios showed my vpn ipaddress as 10.1.0.0. 

Changed internal ip addresses to 10.0.0.x with subnet of 255.255.0.0.  Did all the reboots/ refreshes/ redownloading of vpn files....... iosOpenVPN gives ip address of 10.1.0.0.   

Yes it does look as if vpn "adds one" to DHCP range, effectively placing you on another subnet, which cannot access devices on the main lan if they are set to "block" via access control..........sigh

Ok, If an official netgear rep/engineer could chime in on this, it would be helpful. An ability to set the ipaddress of the VPN clients would be great.  Or at least stop +1 the DHCP range placing you on a different subnet.  This does not play nice with "Access Control" feature of Orbi. (I have read that you can do this in openvpn server.  Not really applicable in Orbi owner's case  But to be able to do this from the router would be appreciated.

So in my case, the only option I have is to "allow" access to my cams, but block all ports.  My last question is if I block all ports (tcp/upd) is this essentially the same as using "block" in access control?

CrimpOn, thank you so much for taking the time to help!  Thank you ekhalil for helping as well!  I really appreciate it.