I don't think this is doable today, but this is possibly a feature request.
I use the Global Proxy VPN configuration with non-vpn traffic disabled. This works as intended but sometimes there's a device/application I don't want to go through the VPN (e.g. Netflix, Youtube, etc).
I wanted to use policy mode by client device, but it doesn't seem I can continue to keep non-vpn traffic disabled for devices not specified to go through the VPN. If I turn off "allow non-vpn traffic", then I risk my client devices on the vpn using their real IP if the vpn server ever goes down.
Has anyone faced this problem?