I think the issue is the APP
There should design the model like :
Per-APP have a tag when go through to the dev
Then the dev have a tag bind to the APP
So every-APP have a default tag
Per-APP1 have tag-a then Dev-vpn have tag-vpn
If we need App1 go through to the tag-vpn
just using the tag-a bind to tag-vpn
Just like a network-link