In general, Bazzite being immutable just means the core system isn't modular to the end user to the degree that Arch is. You of course can use flatpaks or appimages like any distro, and there are still several ways to install traditional rpm/deb/aur programs (the usual Fedora method doesn't work because dnf doesn't exist). If it's just an app that doesn't require significant integration with the OS, the recommendation is to install them into a distrobox container (where dnf does exist) and then distrobox-export [program] to make them visible to the host system. VPNs need a little more integration so those are installed by layering with rpm-ostree and then enabling the systemd service(s). Layering makes updates take longer to install so it should be avoided when possible.

One of the interesting things about Universal Blue's images like Bazzite is if you want the benefits of atomic while also having a more custom system than they offer without having to install a bunch of things in rpm-ostree, the process to build a custom image based on one of theirs is apparently quite easy to do and automate, though I haven't done it myself.