[venatiodecorus]

mullvad offers a socks proxy. i generally use the wireguard app, and only allow traffic to the socks proxy through the vpn, and configure firefox to use that socks proxy.

if you use their app it depends on your operating system how their whitelisting works, but you can pick apps you don't want to have routed through their vpn (but by default with their app all system traffic will be routed through the vpn except what you explicitly deny).