The question is very good explained with the diagram. But, sorry, it also shows that it is a very complex situation I can't give a detailed answer without access to the network to analyze its behavior step by step. And I'm afraid that it will be voted to close because it isn't restricted to Raspberry Pi. There are many other components involved for your solution. It is a general networking question.
But here are a few thoughts at first sight. Wireguard is an encryption application and has mainly nothing to do with user access. It is not the right tool to manage it.
Network restrictions are managed by a firewall, that is nftables (replaced iptables) by default on Linux. This is made to control devices on the network, not user accounts. If you are happy to restrict only device connections then this it the right tool. But any user who is able to login to a specific computer can use its resources.
The ultimate but most complex solution with user accounts is to use kerberos. With it you are independent from the network infrastructure. You only have to ensure that all devices can connect to the kerberos server. Then authentication is controlled on the device itself. You cannot only control login, you are able to control access to different services on the device. You may specify that a user can login and use the NFS connections to copy pictures but not to use the camera service to manage it or take pictures.
