It’s definitely not required. ProtonVPN has a flatpak client, so it’s not like the client can’t exist in other layers, in theory.
I may have to follow up with IT, because they have OVPN for connecting to a different domain on the network, but not this one (probably low priority to change). Perhaps they can offer a way to connect that isn’t this specific client.