Last tested: Sep 30, 2020
This will essentially be a problem.
Since IP allowlist will limit incoming traffic from certain IP addresses and the VPN allows all users to come from only 1 IP address, if the embed users aren't using the VPN, they will get blocked by the allowlist rules.
At the moment, the workaround is to have two instances, one for embedding and one for Looker users.
This content is subject to limited support.