VLAN 4095 does not restrict traffic to tagged traffic only. It just allows for VGT, which means that VLAN tags will neither be added, nor removed from ingress/egress network frames by the port group. It's the guest's sole responsibility to handle the frames, i.e. send them tagged, or untagged.

André