Question about vpnQube to do different tasks for each Qubes

In this article, you will learn how to create a sys-firewall and sys-net. Except for checking provides network, it would be fine if you refer to sys-net or sys-firewall that already exists, right?
If I create a sys-firewall and sys-net in this way and use a VPN, will I complete the isolation of each Qube?