Configurations described in File functions for apps in restricted app groups override the configurations in the Restricted application actions listing and File activities for all applications in exactly the same rule. If you would like the action for VPN being the one which's used, go the VPN