AIUI, with Trio, you don’t have to disable a physical port, but that comes at the cost of “Tunnel gets whatever bandwidth is left after physical port packets are processed” and likely some additional overhead for managing the sharing.
This was pretty much my understanding as well, last time I dealt with this. On MPC/Trio , you just enabled tunnel-services on a given PIC, and landed your tunnel there. The tunnel capacity was just part of the PFE capacity.
Was only on pre-Trio that the bandwidth keyword was required, and that actually reserved that much capacity strictly for the tunnel.