Actually, the EU has a mechanism for opt-outs from the common policies. Some countries opted out of the common currency, migration, security. The UK was never fully in the Schengen area or the currency. Denmark is still out of the defense policy (will change probably in June with a referendum). Poland is currently fighting EU on its "rule of law" prerogatives... The EU doesn't encourage these opt-outs, EU wants the Union to be as comprehensive and profound as possible.
But interestingly enough all the eastern countries have only been accepted to EU after they joined NATO. It is like the EU doesn't want to take a defence responsibility for these "small vulnerable countries" until these countries have the NATO(US) umbrella.