I do something like this. I run wireguard in a container along with dante-server (a socks proxy daemon). I then configured a Firefox profile to connect to the socks daemon running in the container.

This way I have a single browser profile that is routed through Mullvad while everything else works normally.