I think that in this regard, you can use my recently-posted "extnet"
Vdsm hook. You should manually create a libvirt NATed network on each
host and then add the "extnet" custom property to vNICs that you want to
be connected to it.
You may use another hook to automate the creation of that libvirt
network. If you provide more details on how you manually configure your
VPN, we may be able to help you write such a hook.