In other words, I want all (or optionally, some) hosts in site B to reach the internet via site A's ISP.
How would I approach this?
Normally, we build up a VPN tunnel between two sites so that they could privately and securely reach each other. In this case, the Encryption Domains (local and remote subnets) are limited to the subnets we have at each site.
Now, we want internet traffic for Site-B to pass through Site-A (Site-B_internet traffic runs over the VPN tunnel between Site-A and Site-B), you would need to modify the Encryptions Domains at both ends to cover all Internet hosts/IPs -
At this time, when Site-B wants to access the Internet, traffic is encrypted and sent over the VPN tunnel to Site-A. At Site-A this "Internet traffic" is decrypted and forwarded out to the Internet.
I wrote an answer for a similar question in our Networking SE site but on Cisco devices at here. I hope it would give you more ideas.