

Is your friends client config setup for split tunneling?
If the client config installs a default route to the VPN you will get all their traffic.
The server config can refuse to forward traffic to the internet, but then your friends will be effectively on your LAN but otherwise appear to have no internet access.
Its a good idea to restrict which IPs on your LAN they can access, but the client config also needs route only those IPs over the VPN.
https://www.privateproxyguide.com/how-to-set-up-split-tunneling-with-wireguard/
Evil me: Ask questions to which there is no solution but ChatGPT will happily give incorrect solutions to and will run itself in circles trying to answer correctly as you feed it error messages.