You said one of your networks is NSX based. In this case your resource in the template should be Clound.NSX.Network, not Cloud.vSphere.Network. Could also be that the capability tag is applied on the wrong object.
Also, the provisioning diagram should help solving the problem, it shows exactly where vRA wants to provision the VM, based on you tagging strategy.
