Because vSAN and Management both use the same TCP stack, if vmk0 (Management) and vmk1 (WitnessPg) are on the same subnet, you will observe a multi-homing situation (KB 2010877).
You could tag only vmk0 for "vSAN Traffic" if you desire, as this is a supported configuration. Keep in mind you will want to isolate/protect that network from non-administrative access.
I go into some more detail here: Understanding the vSAN Witness Host - Traffic Tagging - Virtual Blocks
Thanks Jase for the info. Since it's a new build, we will request our vendor to split the vmkernels instead of using both Management and Witness traffic on just one vmkernel.