Can we separate application servers that serve different purposes (reading, writing, etc) onto different network segments?

Absolutely, there is no limit on the operations a client application server may perform given the correct authorization. It may also be wise to choose to put the highest volume application servers on the same network segment as Swarm in order to remove the latency of routing and the bottleneck of having to pass through a router to communicate with the cluster.