

Squashing per-user is a blanket measure intended to default “public” users into a default access permission.
It is usable according to your layout, but this is effectively logical control preventing users from affecting files that aren’t their own.
And if that is the goal, you might as well set this up as library access through immich.

My VPN tunnel automatically turns on when I leave my home lan. All traffic is tunneled and leaves my home network.
Are you able to use the internet with VPN turned on when you’re out and about? You may simply need to set that.