Evolving Delivery Optimization beyond classic VPNs

Delivery Optimization settings allows to 'tag' a connection as VPN using the policies VPNKeywords and DODisallowCacheServerDownloadsOnVPN. 

However the era of classical VPN's is ending with solutions like ZScaler Private Access where these policies become useless.

In my opinion Delivery Optimization lacks alternative mechanisms to control use of (avoid access to) MCC Cache Host servers.

How can we avoid use of the MCC Cache Host servers over solutions like ZScaler Private Access?