Just to share quickly what I usually recommend to people and that seems to work real well. So, for all the interfaces, we assign zones to them and then say you can create inline parent rule, that goes like this ->
src -> internal zone (referencing internal interface), dst -> any -> vpn -> any , services -> any -> action -> create new layer and call it say "internal layer"
Then, below that "parent" rule, you can set up all the child rules (as they call them) and at the bottom, you will have any any drop, which is EXPLICIT clean up rule...NOT to be confused with IMPLICIT clean up rule, always very last at the bottom of the rule base
Having said this, we always say to customers to create VPN rules towards to top of the rulebase, not part of any inline layer, so that way, it would not "conflict" with anything.
Hope it makes sense, but happy to show you in my lab as well.