VPN tap tunnel: client side only on a specific ethernet port

Hi

I have a Asus RT-AC68U with asus merlin firmware.

I would like to know how to set up a vpn tunnel as follows:
My asus shall act as a VPN TAP client, BUT only a specific lan port must be assigned to use the VPN tunnel (lets say port3).
Doing so whatever devices are connect to this port3 (using a second switch) are managed by remote DHCP server (VPN server segment).

Sp my question is....how can I tell to asus merlin "this VPN Tap tunnel must be binded to lan port 3, all the others ports...

VPN tap tunnel: client side only on a specific ethernet port