I think that it’s definitely a good case for overlaying with install. They say to use it sparingly because it increases the chances of something breaking, but that doesn’t mean it will. Something like a VPN usually needs liw level access that container isolation makes difficult.
I’ve only had 1 issue on silverblue years ago where I couldn’t update because I had vim overlayed and they fixed it within a day or two.