Per App VPN and other network activity
The VPN applies only to those apps, not all the traffic from the device. See Per app VPN (enterpriseios.com)


  Apps can phone home through a VPN tunnel as soon as they are launched, and send all their network traffic (and only their network traffic) through it. This is controlled by the MDM admin, not the app developer.
  It will use it for all domains. The SafariDomains key specifies only those domains that trigger the VPN connection.
  
  Additional reference - Configuration Profile Reference sections:
  Per-App VPN Payload
  VPN Payload