Full Mesh VPN - Looking for Guidance

Hello, I'm hoping that someone can help point me in the right direction (or provide a simple example) for what I need to do.

I am looking to do the following:

- Set up a Mesh VPN between 3 sites. Main site has 2 60D devices in HA and has VPN tunnel to Azure. Other sites have only 1 60D. Single ISP in all sites.

- Need to limit traffic across VPN to some subnets only.

- Need to restrict some subnets to communication in one direction.

- Need to route traffic to Azure from other sites via Main site.

OCVPN not an option at this time.

Thanks in advance.