[Vuejs]-Can Vue or React SPA block access for some pages?

All the code of the SPA doesn’t need to be loaded as one piece at once. You can use Async Components to split the code into multiple chunks loaded dynamically at runtime only when needed. This is especially useful in your case as the code for the Admin part doesn’t need to be downloaded/parsed/executed by non-admin users (which is probably majority) – see Lazy Loading Routes

On top of that your Express server app should authorize every server call anyway. If unauthorized user somehow manage to execute and display the Admin part, it will be useless for him if the server doesn’t return any "admin only" data to display or allow any admin only operations to be executed on server side…