Like others have said, running a DE with remote capabilities will be a lot of overhead.
If you set up portainer and watchtower using ssh, you can pretty much just manage everything from portainer while watchtower makes sure that portainer and the rest of your containers stay updated. It’s a very hands-off operation, especially if you set up auto updates on top of that for the pi OS. You’ll probably just have to ssh in periodically to run a system upgrade and maybe restart to update the kernel.
If you use docker with portainer (for the GUI), you can set up the gluetun container with your protonvpn account and run all your other containers through that as their network. It’s as simple as adding
network_mode: service:gluetun
to your stack configuration for each container.