I’ve been spending some time on tags in the last few days and it seems to me the best solution would be to add a “this is a staff tag group” option to the tag group admin. Then only display staff tags to staff everywhere. That way staff can use all the tags everywhere, but not leak internally used tags to non-staff.
Even more useful would be a “tag group security” tab similar to categories, which would make it possible to have discourse group specific tags. We have a whole section of private categories in our community that is only for staff of my 100+ organization and the managers of that section often want to use tags that make no sense for the public categories but that are very useful for them. We also have team wikis and such that would benefit from having their own tags which also don’t make sense for the world to see. But that would open an even bigger can of worms, I am sure. 
Below are example “admin tag groups” I am considering for my site to use it as a support ticket system. It would be beyond lovely to be able to use them for both topics and messages, but not allow anyone to see them except staff.
Status
- New
- Underway
- Waiting for reply
- Resolved
- Backburner
What is this about
- Feedback
- Something is broken
- Member Account
- New Member Welcome
- Member Profile
- …
Priority
- Immediate
- Urgent
- High
- Normal
- Low
To be clear: I do think the tags used in PMs should show up in /tags because that is the interface staff use for managing tags as well as providing access to them all in one place. But I don’t think tagged messages should be included in /tags and there should be a separate way via messages to access tagged messages. The simplest MVP might be a /messages/tags page but maybe someone can think of a better idea to enable staff to use tags to find their way around messages and handle them on a timely basis.
All of that said, I would be most comfortable if I could suppress the /tags page from non-staff altogether until this is sorted out, as I suggested elsewhere.