Install wireguard, easy to install with pivpn or docker container.

Then just change these settings in the client config.

Let’s assume your pi hole ip is 192.168.1.10

DNS servers:
192.168.1.10

Allowed IPs
192.168.0.0/16

So only your local IPs will go through the VPN. The DNS will be like you are on your LAN and you can access all your domain.tld services without exposing them to the internet.

What do you thing of Kasm Workspaces.

You can create a Desktop workspace, different diestros and environments to choose from. And you can create users so each user has his own login.