A network tag can be used in firewall rules.

When you launch a Fleet Manager instance, the network tags of the associated virtual network will be assigned to the GCP provisioned instance.