Determining source app of IP traffic in NETunnelProviderManager
It says specifically on the NETunnelProvidermanager specs, "The only way to configure "per app" VPN is with MDM..." so in terms of the mainstream way of meeting all the Apple specifications, and at least in the context of Apple Stack Exchange, it seems this would not be possible.  I hope someone else, or I, can find a nice workaround for you though if it doesn't work.

One tip though:  it does discuss directly below the VPN settings, in the spec guide, how to configure on-demand VPN, and if your requirement is not that that the VPN is "always on," you may be able to meet your specific goal just by creating the necessary certificates.

You may prefer to to make the .mobilconfig files by hand once you see the options and syntax available, but you might be able to generate only exactly the certificates you need, for example the VPN, using Apple Configurator without having to completely take control of the device.