What is the best secure stand operating procedure for a VPN setup?

I am planning on testing a VPN setup and I am wondering what is the secure standard operating procedure/steps for that setup?

I do not want to acess my whole network from the VPN, I want to use the VPN majorly as a method of secure communcation when accessing the net from an open wifi network (i.e. coffee house).  I do not trust other VPN providers like PureVPN, I want to roll my own.

Now I want the users who connect to the VPN to not see my internal network (have them on a seperate virtual network).

My current diagram is:

FIOS ONT ethernet enters the XG WAN side, LAN side connects to the LAN1 port of FIOS Quantum Router (quantum router is on a passthrough mode),  The FIOS quantum router via LAN2 connects to my DDWRT WiFi Router via LAN1.  All other computers connect to DDWRT router.  The DHCP is being handled by the XG firewall.