Hello and thank you so much for quick response!
The service application running on the host must be able to tell which client has connected to it via vsock. I have working code that runs on Linux (based on a "classic" vsock implementation), and it has to use different port numbers for each client, otherwise it would be impossible for multiple guests to connect to a single host.
I tried to reuse the same approach in macOS, but it seems to be impossible. However, I understand it is not even required in macOS, since VM instances run by the Virtualization.framework are already isolated from each other. When the host app receives an incoming connection, it will be able to tell which client has connected just by using different VZVirtioSocketListenerDelegate.
I haven't tested it yet, but I feel like this approach should work. Thanks again for clarification!