Do we have to send all of our traffic through VGS Proxies?

No, you can segment traffic by assigning a custom CNAME such as vault.company.com and then redirecting your sensitive traffic there.

See also How do I configure my DNS to work with the VGS Reverse Proxy?