So first you need to add repository for PHP 5.6, "here are packages directly from a maintainer of Debian's PHP packages, Ondřej Surý."
$ apt-get install apt-transport-https
$ curl https://packages.sury.org/php/apt.gpg | apt-key add -
$ echo 'deb https://packages.sury.org/php/ stretch main' > /etc/apt/sources.list.d/deb.sury.org.list
$ apt-get update
Now the key is to install just the right php package, in the case of virtualmin running default FCGId mode, it is:
$ apt-get install php5.6-cgi
I also wanted mysql/i, gd & xml support so:
$ apt-get install php5.6-mysql php5.6-gd php5.6-xml
These will both install a few dependencies as well.
service apache2 restart
Now you should be able to run "System settings"->"Re-Check Configuration" and look for the line that should say something like this:
The following PHP versions are available : 5.6.40 (/usr/bin/php-cgi5.6), 7.0.33 (/usr/bin/php-cgi7.0)
Making sure that both bin's are -cgi variants, this was what got me as i had one detecting as plain php5.6 without the -cgi bit.
Now you should be able to go to "Server Configuration"->"PHP Versions" and select the new (older) version we installed.
Also now check if in "Services" you have an new option to configure the new 5.6 php.ini too, otherwise (eg it was an existing server) you need to go to "Server Configuration"->"Website Options" and change from FCGId to CGI wrapper and back to FCGId again, this will generate your php.ini in the new section.
Now finally you may want to comment out the new apt source we added earlier to stop your 'regular debian' php packages from being upgraded from
#deb https://packages.sury.org/php/ stretch main