Hello,
actually the Demo mode should work across subnets as long as long as computers can reach another via normal TCP/IP routing (NAT is not supported). Unlike other products, the demo mode in Veyon does not work with UDP broadcasts but TCP connections. When starting a demo on a computer in a different subnet, does it display the IP address of the teacher computer properly?
Restricting access to computers is possible through access control rules. These rules also allow you to e.g. restrict access to computers at the same location as the teacher computer. Other scenarios are possible depending on your environment and AD structure.