Check this and this posts to see how you can make a VPN qube that your AppVMs can use for their entire network traffic.
You can place your VPN qube just after firewall qube for all of your AppVMs. dom0 does not have internet connection, and as far as I know it shouldn’t have.