Global Secure Access - Private Access segmentation

We are just starting to evaluate Private Access and are already experiencing the first problems.

We have our internal network area 10.0.0.0/8, local dns, some external partner dns, which should be accessible for all users (Active Directory ports, HTTP/S and SMB)
At the same time, the IT staff must also be able to access the area via SSH, RDP and much more.

I cannot map something like this with Quick Access and one IT enterprise apps, but only via two enterprise apps without using quick access because of overlapping? Is that right?