Bordermanager/TELNET

We are running Netware 5.1 and Bordermanager 3.6. Several of our VPN clients need a Telnet conection to a VAX system on the LAN. These sessions must initiated by the client and I am leery of opening up Telnet from outside my network. How can I set up their access to allow the least exposure – with filtcfg, in Bordermgr or some combo of the two ?