I am not a sharepoint expert so I will have to tackle this one in a generic way - if something is special about sharepoint this might not work.
A vApp would contain several systems, for example it might have a SQL database and a application server (sharepoint?). Each would have internal IP's configured and that is how they would connect to each other.
The application system would also be setup to have NAT and firewall rules to allow traffic from "outside" the vapp.
Once configured many copies could be created of this full vApp as the database and appliaction think they are the only systems running (as they can not see outside the vApp network they are connected to).