I found this page: https://developer.apple.com/documentation/devicemanagement/vpn/alwayson/applicationexceptionelement
Which indicates that it can be done. However, when