OpenVPN allow two clients to connect to each other without using client-to-client globally
I suggest you do the reverse: enable client-to-client and then use iptables to block all clients but the two you want to allow to talk to each other.
I know this question is old, but just to clarify that to new users that might still be visiting this page:
if you use client-to-client you can't actually use firewall, the server will not even see those packets at all as they never come back out from the OpenVPN server, so, since they are not reaching host layer, you will not be able to use the firewall as it won't be reached and your rules would be useless in that way.