The Physical ESXi host that the appliance runs on must be managed by a different vCenter than the ones deployed by VCF. The vSAN Witness should be running completely independent from the cluster it is being a witness for, including all networking.