It is apparently possible to use Firefox containers to bypass or enable a VPN on a per-site basis. I discovered this yesterday and it makes using a VPN nowadays much easier, wish I'd heard of it ages ago. Using a SOCKS proxy this way also reduces captchas.

To setup:

1. Install Firefox Multi-Account Containers.
2. Install Container Proxy.
3. Add VPN config under Extensions (puzzle icon in toolbar) > Container proxy > Proxies (for example, Mullvad SOCKS5 proxy).
4. Make sure "Proxy DNS requests" is checked and the Uncloak canonical names setting in uBlock Origin is disabled to prevent DNS leaks.
5. Assign VPN to default and private browsing container.
6. Create a new container named e.g. "Unsecured" with the Multi-Account Container add-on and assign it a direct connection (default).
7. In VPN client, configure Firefox to use split tunneling. Example split tunneling with the Mullvad app.
8. Test default and unsecured containers against VPN website.

The Container Proxy add-on is only needed to configure the unnamed default and private browsing containers. If you want to do the inverse (create a VPN container and leave the default unprotected), you can do that solely with Multi-Account Containers under Extensions (puzzle icon in toolbar) > Multi-Account Containers > Manage Containers > Container > Advanced proxy settings.