I a considering to allows only “local” network to configure the router and for remote maintenance having a VPN. Is this considered a good practice in such case? How do others, are there any good recipes around?
That is the recommended way, VPN, if you have to config remotely.
I use IKEv2 VPN with the mikrotik app on my iphone for example.
Build your VPN network for this purpose. You can use any router as a server, with the others connected to it. I use on each PPP profile with a selected bridge/vpn br/ created for this purpose and a specified IP address from the VPN network. Example I have chosen to use sstp with certificates for VPN management network!
do you mean using another router for it?