Can I create dumb "proxy" (vpn) record that will in fact act as "no proxy"?

[onetimecontributor]

I want to keep one of my real VPN proxies to catch all aps unless they're assigned to other proxy. It's done via "Always-on" in Advanced mode. That sounds like a safe way, so if I "loose" some app (or for new ones), it will not leak/access internet directly.
However, there are few apps that should have direct access to internet under certain circumstances.
I thought I could group those apps under "dumb" proxy record and enable/disable it on demand (lockdown = on), while still having default "Always-on" in another real vpn profile. So if I disable that dumb proxy, assigned apps are blocked, instead of (current) allowed (if to use "bypass" instead of requested "dumb" proxy).

Thus, is it possible to prepare vpn cfg file for import that will result in actual "no proxy" behavior?
Like set no keys, peer address to local, etc...

[ignoramous]

However, there are few apps that should have direct access to internet under certain circumstances.

Turn ON Bypass app from proxies for it from Configure -> Apps -> Search (for that app).

So if I disable that dumb proxy, assigned apps are blocked, instead of (current) allowed (if to use "bypass" instead of requested "dumb" proxy).

In this scenario (assuming Advanced mode), the app will be routed to any of the Always-on WireGuards.

[onetimecontributor]

Thank you for the reply. I already use combination of exclude+isolate and it's super that it works this way (apps can access only limited addresses, like lokal ones for wifi direct printing) thank you!
the original idea was more about "grouping" those apps, so I can disable their connectivity at once, like I can do via WG proxy record (if I disable that proxy).
but it's rather minor)