I don’t follow your architecture.

Say the Slate is controlling a 192.168.8.xx LAN, and your openvpn client is connecting to the openvpn server run by the Slate. In TUN, the client is given a 10.1.8.xx IP address (or something like that), and the Slate adds a route from that subnet to the 192.168.8.xx network. But only routing traffic goes between the two and over the tunnel. In TAP, the client is given a 192.168.8.xx address, and all the network traffic (broadcasts, bonjouring, etc) passes to the client over the tunnel.

I follow you have a NAS or something that has two NICs and serves two separate networks, but the other network must be served by another router, no? So I’m not following why this governs TAP vs TUN.