This is what i do with customers. I use Synology and no-ip, so things just work.
Like the above recipient said, in the plain English config, set their dns to not be forced across vpn (“split”, or “split brain” in google). The split is simply that traffic bound for your central LAN will go across the VPN, but other traffic will go via your default gateway, whatever that is, whether it is a laptop at Starbucks, or a home PC.
It sounds like you don’t have that many clients, so you should be able to just create one client in the OpenVPN wizard, and the VPN they will target will be a /24.
I use for authentication passwords as well as certificates in the client export part of pfSense. Some people prefer to give out individual keys. I do mine because it’s just easier and it’s not government work so it works great. It also gives my customer one client to download from a local server, and then I get to manage their usernames and passwords usually via a domain which is set up on the Synology as well. This way, their passwords do expire, and they have one user password combination to manage across not just the VPN but also the shares on the NAS.
I must have 20 or so customers set up this way using OpenVPN, including some whose offices needed to be connected, so those are set up as site to site, and they just work like a dream. You set them up, and you never have to touch them again.
There’s plenty of stuff out there on the internet to show you how to do everything, but I don’t know which Nas you are using. As long as it supports/creates Windows domains, like Synology does, tying your firewall to a VPN is a dream compared to trying to manage separate lists of users and passwords.
Here is a link to how easy it is to set domain authentication up on a Synology, which to PFsense is identical to a Windows server:
This isn’t the only place how to do this is documented. Lots of videos out there walk you through the process. I noticed with PF since menu options come and go depending on the version that you were on, and whether you are using the plus version. But don’t get hung up, just use common sense, as in the origin of the firewalls name, and it will work like a dream.
As always, back up your configurations. Don’t want to have to figure this out again. 
