VPP vs App Store and MAM question

Could someone enlighten me on the difference between VPP apps and those added from the Apple store (in the Intune Apps blade), specifically for the free Microsoft ones?

In my specific scenario, we've deployed a MAM/APP policy for Office apps (e.g. Teams, Outlook) to unmanaged devices only, however we found that managed devices were getting the policy.

We dug deeper and realized that the managed devices were indeed corporate managed, but the affected apps were downloaded from the App store manually.

We've seen references to the IntuneMAMUPN property that may need to be set via a App Configuration policy.  

My ultimate questions are:

• Must we use the VPP version of these Office apps, or can we add the App Store version for deployment via Intune.
• To prevent MAM policy from applying to these apps on managed devices, must we push the IntuneMAMUPN configuration to each affected app, or will deploying the VPP version of the app satisfy it.

Thanks in advance.  And I apologize if I'm mixing up any terminology as I'm trying to learn this system.