Basically what you said, I image internal routers get BGP info from the VPN server to determine what ports to open to what VLANs. I haven't actually seen this done, but imagine it might be done on a big korporate LAN.