constraint tags are the equivalent of syntax:expression: in the old style templates.
Constraint can be a regex or a call to an external validator, possible with an argument. Validators are stored in ${vyos_libexecdir}/validators
The new syntax:
<properties>
<constraintErrorMessage>Foo should be "bar", "baz", or a number within 0-9000 range</constraintErrorMessage>
<constraint>
<regex>^(bar|baz)$</regex>
</constraint>
<constraint>
<validator name="numeric" argument="--range 0-9000"/>
</constraint>
</properties>