Is there a way to push all SSH traffic through OpenVPN

[megatron36]

I am trying to find a solution for a client which will allow them to push all SSH traffic over remote access VPN? they are also requesting that it must have split tunneling and all http/https traffic must go out over the local internet. Is this even possible? they currently have a fortigate, which says no its not possible, I've called a few other vendors who say their VPN solutions are not capable of that. I know in cisco you can force specific sites to go over the VPN but you need specific IPs and it is not recommend. OpenVPN might be able to do it but I might be misinterpreting what I'm finding. Has anyone come across something like this before and can point me in the right direction?

Basically this client has a lot of remote workers who download large images which is why split tunneling is a must. They work through AWS and SSH into the boxes. The security for this is getting out of hand as they have a lot of servers and they are putting everyone's public IP in the security settings to allow them to access the servers. They no longer want to do this and only use their public IP for security reasons so we are trying to get a baring on how one would be able to accomplish this as they want 1 point to cut all access to the servers if a user would leave or be terminated.