Short answer, you can't.
Longer answer, as mentioned in the documentation you linked to, Visualforce page permissions are checked at the top level only. If you have access to the top level (Vf1 in your example) then you have access to everything that it depends on when accessing that page (which means you have access to Vf2).
Permission for a Visualforce page is checked at the top level only. Once users can access a page, they can execute all Apex that’s associated with the page. This includes:
- The controller for the page and any Apex classes called from the controller class.
- Any extension classes for the page and any Apex called from an extension.
- Any Apex classes associated with custom components within the page.
- Any classes associated with the page through the use of apex:include or apex:composition.
You could use the
rendered attribute on your
apex:include and query if they user has appropriate permissions in your controller, but that would end up being messy.
I would recommend that you re-think your approach and instead consider having two completely separate Visualforce pages one which includes Vf2 and one which does not. Then you can assign the permissions as you desire.