I run Bazzite on a HTPC, and it's great, but I'm still deciding what to put on my daily driver PC, which needs to be able to do things like gaming and coding. As you also pointed out, Fedora atomic distros don't like VPN clients that aren't already packaged neatly as an RPM.

In light of that, you can either try to build your own custom downstream derivation that pulls from the upstream image of your choice (Universal Blue has instructions and a template for doing this) and make customizations to the system at build time, go with something like Blue Build, or go for a traditional mutable distro.

I've been trying to get Private Internet Access to install at build time on my own custom attempt, but so far, it's been a failure. I've also tried on other immutable distros that use ostree alternatives, and they've also failed. I may just have to concede the client and only use the preset OVPN configurations, or I may need to move onto mutable options.