Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
Adding a VRF under service firewall redirects routed traffic in that VRF to the DPU. Adding a VLAN redirects bridged (intra-VLAN) traffic to the DPU. If user only needs to inspect inter-VLAN traffic, securing the VRF is enough.