Can Passbeam authenticate our VPN as well as the network?

Yes, with the same certificates. Add a gateway on the client's VPN access tab, one for each device that ends a VPN, whether that's the firewall or a VPN server behind it. Each gateway gets its own shared secret and its own list of addresses it can send from. People connecting from home use the same certificate that gets their laptop onto the office network, so revoking it takes away both.

Whatever ends the tunnel has to be able to pass EAP-TLS to a RADIUS server. Check this first. Plenty of gateways support RADIUS but can only send a username and password, and those can't use Passbeam. Look in the VPN settings for EAP-TLS or certificate authentication with RADIUS, not just a RADIUS option.

A VPN gateway uses standard RADIUS over UDP port 1812, not RADSec. Both server addresses are on the VPN access tab. Add both. Every attempt shows in the same authentication log as the switches and access points, with the gateway it came through.

The checks are the same as on the network. The certificate is checked, the person's Entra ID account status applies, and so do any group rules for the client. When someone leaves, they lose the VPN at the same time as the Wi-Fi, without anybody changing the firewall.