Ken, it's possible to run a multi-module Java Appengine app, with your first module running in the classic GAE "sandbox", and the 2nd module running a managed VM, and through a login:admin setting in your app.yaml configuration or similar, you can lock it down so that only your other Appengine module can access it, and so that it's hidden from public.
Check out
this article for more Java-specific details. (When at least one of your modules is running GAE Java)
And when you run gcloud preview app run <module1> <module2>, make sure to specify the prebuilt war directory of your GAE Java app.
Regards,
Avanish