Can I route only external traffic of one device through a VPN?

There are different ways, depending on how much transparent you want it to be. You can use e.g. config from this thread as starting point, it just need some tweaks for when you add VPN.