There's not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatory network isolation policies to deploy Application Guard are different between CSP and GP.
Mandatory network isolation GP policy to deploy Application Guard: DomainSubnets or CloudResources
Mandatory network isolation CSP policy to deploy Application Guard: EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)
For EnterpriseNetworkDomainNames, there's no mapped CSP policy.
Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard doesn't work and results in an error message (0x80070013 ERROR_WRITE_PROTECT).