AWS: Route traffic from Site-To-Site VPN --> Specific Subnet

Question

Inside a vpc I have 8 subnets (4 in each AZ) connected to 100 VMs.

I have a Site-To-Site vpn setup in AWS for an external customer. The goal is to allow only one VM is to be accessible to the external customer.

There is a vpg associated with the vpc. Security Group configurations have created a number of pathways to other VMs.

I have created a new Subnet and I want to route the traffic from the VPN only to this new SubNet.

I thought this would be done with a Route Table, but I do not cannot see how to do this.

I created a new subnet and Route Table. I associated the new subnet with the new RT. I created a new route:

I got the following error:

The destination CIDR block 192.168.11.0/24 is equal to or more specific than one of this VPC's CIDR blocks. This route can target only an interface or an instance.
Goal: