When considering the small network design requirements in a branch role rather than a headend or standalone role, the following should be noted:
VPN connectivity for remote users is normally not required because it is provided for by the corporate headquarters.
Management servers and hosts are normally located at the corporate headquarters, requiring management traffic to traverse the site-to-site VPN connection.