You could run a portal login helper in a network namespace that doesn't go through the vpn. https://www.chromium.org/chromium-os/chromiumos-design-docs/...