APM Protected workspace only for App tunnels

Is it possible to make App tunnels work only within a Protected workspace while all other portal access do not use this. What we are looking at is when the user clicks on an application tunnel resource it should start within the protected workspace. It will be great if someone can suggest a solution if this is possible.