@RyanFav 

For the isolated networks, at present I have each LAN port on its own VLAN (only untagged for the port, because tagging I believe needs a L2 switch following it?), then have access control blocking all combinations of LAN-LAN between these VLANS

right. switch that supports 802.1q vlan

lan-lan blocking has been supported by the controller as far as I know. if the controller supports that, standalone can do it as well

At present I have a PPTP VPN Server setup, it connects, It can see the router for any of these VLAN's DCHP ranges, but nothing inside them, I've tried static routing, setting up its own IP group and routing the IP groups, disabling the Access control limitations, all to so far no success?

not sure what you mean "it can see the router for any of these VLAN, nothing inside them".

don't try things unless you know what's it used for. static route only works for the subnets or IP that do not know where to route. then you create a route to this subnet/ip, telling it where it should go. 

what I read is that your plan:

vpn client can only access a vlan? i.e. vpn client #1 only access vlan 10, not other vlans you have?

fact is, by default, vpn client should access the lan unless you have set an acl to block it. what's your result?

for any non-RF products, you are free to use the UN firmware from anywhere you can find. 

only the rf products require you to download the matching firmware to the hardware. or your device will block the upgrade or upgrade and brick.