I have found one solution, maybe it's interesting for someone:

1. Disable / Clear the Default Gateway in the WAN Settings.

2. Create a route to the other VPN-Router with the former Default-Gateway as the "next hop".

(Optional: If you need DNS in the VPN-Router, create a route for that, too.)

So, no need for complicated Firewall-Rules or disabling NAT (which does not work)

  @Micky_Roth I haven't test but I think ACL may also work. Two rules:

1. Allow Any LAN to Remote Gateway LAN;

2. Block Any LAN from DNS protocol.

The limitation is it will only block website access. Some applications like facebook may still work since they do not need DNS.

Somnus wrote

Some applications like facebook may still work since they do not need DNS.

  @Somnus Also problematic if your clients want to use a local DNS over die VPN-Connection....