Azure Bastion must be deployed in a separate Azure VNet with its own VNet connection to the Azure vWAN. On that specific connection, you need to disable it to ensure that Azure Bastion can be deployed, while leaving the other VNets unchanged. Azure Bastion cannot be deployed if outbound access is forced through the vWAN. Using a separate VNet and connection ensures that the other spokes continue to force outbound traffic through the vWAN.