Hi mydeuter
I hjope I've understood your situation correctly as I've made some assumptions, but here goes. Correct me if I'm wrong:
Easiest way is to have a VPN router at each branch that establishes a VPN tunnel to a bigger VPN router at the central office. At each branch the default gateway will point to the VPN so that all off-site traffic goes over the tunnel to the centre. At the centre most likely your default gateway will be pointing out to the internet, so unless you explicity set up routes for this your branch offices won't be able to 'see' eachother.
