Just want to update this.
Through some testing either sys-net or sys-firewall give the desired results. I prefer sys-net.
I am just wondering if my suspicions are correct for my purposes I require a VPN between my clearnet connection so that all tor traffic passes through the VPN.
The netvm topology on Qubes is as follows
sys-net -> sys-firewall -> whonix-gw -> whonix-ws
I had it running on Sys-Firewall but just realized there’s also clearnet access on Sys-Net.
I’m thinking Sys-Net start with the lowest common denominator.