If Btrfs snapshots + Snapper would have been sufficient, then openSUSE themselves would never have desired the creation of openSUSE MicroOS (i.e. their attempt at an 'immutable' distro) in the first place.
An excellent point.
But to your earlier one, I can get the VPN client working outside of a container. There's even an RPM file from the vendor, so installing it is just as easy as installing any other package.
I appreciate the input!
I may try that. They have OpenVPN for connecting to a different domain on the network, so maybe it's possible a config could exist for the one I need to connect to.