When configuring Veeam Backup & Replication in a VMware vSAN environment, the best practice is to use the Virtual Appliance transport mode. This mode is also referred to as "hot-add" and allows the backup proxy to mount VM disks directly from the datastore. This method is more isolated from the VMkernel network traffic, as it does not require network connectivity to the hosts to retrieve data, thus providing a level of isolation that meets the requirement stated in the question. The Direct NFS and Direct SAN options are not applicable for vSAN, and Network mode would not provide the necessary isolation from VMkernel network traffic.

To ensure that the VM data remains encrypted throughout the backup process, the job should be configured to use the proxies with the NBDSSL (Network Block Device SSL) transport mode. This mode encrypts data transferred over the network, adhering to the company policy that prioritizes data security. While DirectSAN Access is fast, it does not provide encryption of in-flight data.

The Quick Rollback feature can be used during a Full VM Restore to restore only the changed blocks of data since the last backup. This is typically used when the issues are minor and have been caused by VM guest user error, rather than full-scale data corruption or migrations to a different virtualization host. Quick Rollback can efficiently restore the VM to its previous state without the need to transfer the entire VM's data.References:
* Veeam Backup & Replication User Guide: Quick Rollback
* Veeam Help Center: Performing Quick Rollback