You want to know the difference in VPN permissions between Device Admin and Android Work Profiles in the Endpoint Protection Mobile(SEP Mobile) environment.
Device Admin does not allow mobile applications to turn on/off the always-on switch, so SEP mobile's VPN can coexist with other(multiple) 3rd party VPNs.
But with the Android Work Profile configuration, the Android Work Profile forces one VPN to always-on, which denies any other VPN from operating.
If you will want to continue and use the Android Work Profiles, you will have to select one VPN over the others.
If you decide to NOT use SEP Mobile's VPN, you can change the mandatory permission requirement to "Optional - let users decide" which would allow you to complete the installation onto your mobile devices. But be aware, that some protection features require the VPN permissions and may not function properly without the required permissions. For example, the "Automatically launch the SEP Mobile VPN tunnel when a network connection threat is detected" will not work without the VPN permission.
If you decide to USE SEP Mobile's VPN, you will be able to continue to experience the full protection features provided by SEP Mobile.
NOTE: If you configure any VPN to be Always on in Android, you cannot configure any additional VPNs.