Hub and Spoke Architecture

We currently have a customer with multiple independent sites. Each site has it’s own local gateway, clients, and databases. They are inquiring about connecting all these sites together over a VPN and having some central management.

My thought was to install an Ignition gateway at their headquarters (the Hub gateway) and establish a gateway network with the remote gateways at each site.

If we did this, would a user at the headquarter location be able to login to the Hub gateway and launch a project on a remote gateway? If this is possible, would we also be able to restrict users to certain remote gateways based on login credentials?

All sites are currently using Vision modules, so I believe there would be a way to use the re-targeting feature. But we are looking to move them over to the perspective module in the future to gain some mobile functionality. I don’t think re-targeting is an option with perspective clients so what would be our options in that scenario?

Thank you for any guidance