I do think you already got it half the way.
work computer - beryl — some kind of connection (WAN, hotel WLAN, tethering, USB modem, …), here begins the internet, stop.
The Flint cant be before the ISP. This is a whole other side.
Than there is either the Flint as modem or the ISP modem, depends on your setup and what is provided by your ISP. Let’s assume you go online by your providers Router with modem.
Internet - Some outlet on the wall (fiber, DSL, ISDN, …) - ISPs router - Flint - (Multiple devices in your Home Network)
You should not need any portforwarding, because mullvad is the entry. Your clients will ask mullvad, if they are allowed to access. And as you have no access to their infrastructure, it is enough to trust them to handle their ports.
WireGuard and OpenVPN are two different solutions for the same goal. Either you are using WireGuard or you are using OpenVPN. But on all ends the same, they are not compatible. I don’t know what solution mullvad is providing, since I am not using an external endpoint.
The whole Picture:
“Work Comp.” LAN-ethernet-LAN “Beryl” (WAN/WLAN/Tethering)-internet-WAN “ISP router” LAN-ethernet-WAN “Flint” LAN/WLAN-(multiple clients)
Please make sure either the Beryl or the Flint will change the LAN IP. If both have 192.168.8.0/24 as Network, the routing won’t work.