Confine subscriptions and messages to the nested VM