If you're making the VMCA a sub-CA, then you should able to specify that in the issuing CA's delegation cert. Otherwise, for just internal issuance, I'm not sure there's a parameter that controls such behavior.