Who rated this post

The others are correct.  If you're looking to differentiate traffic by client type, then Access Roles are your answer here.  You can define an Access Role object by client type, and use those in your policy.

For best results, you can also define an access role for your regular users and again use that in your policy.  With this, you can remove the "legacy user access" rule for "Vpn_users@any" in the source column AND you can remove the RemoteAccess community from the VPN column.  You will use the access roles to control VPN user traffic; either by your client type roles, or your user-identity roles, or both.  Your user identity roles can refer to internal/local user, AD/LDAP users, LDAP OUs, AD security groups.... whatever you need.