No. wan links always need reachability  to meraki cloud.   You could connect the link on the lan side and  use static routes (+ tracking)   Something like this https://documentation.meraki.com/MX/Networks_and_Routing/Integrating_an_MPLS_Connection_on_the_MX_LAN ... View more

Take a look at this documentation about integration with ZIA.     https://documentation.meraki.com/MX/Site-to-site_VPN/Zscaler_Internet_Access_(ZIA)_Integration   As I informed the rules of L7 are intended for blocking applications.   Cisco Meraki MR Access Points and MX Security Appliances provides the ability to create layer 7 firewall rules to deny certain traffic based on traffic type.   https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_a_Layer_7_Firewall_Rule ... View more