Boucharda - I probably should have been more precise - sorry, I'm a networking guy/engineer so I'm a lousy teacher. :-).
(for sake of this discussion I am going to assume we are in a locale that the content provider restricts and requires us to use a VPN -- that is totally dependent on the stream provider - some are locale restrictive others are not)

Chromecasting has two different modes - Screen mirroring and full streaming (Casting):

Mirroring: If you mirror your device to the chromecast, then yes only your laptop has to be 'behind' the VPN. Basically it will 'mirror' your display to the chromecast. That means the content is streamed between the streaming server and your laptop, and the screen content is 'copied' and sent to the chromecast. While this works, it can result it stuttering, and resolution loss, and it puts all the load on the client device (laptop or phone). It also results in higher network loads because the content goes from server->laptop->chromecast. You should use this mode only when whatever you want to cast does not support casting natively (see 'Streaming' below) -- I believe that is the case with DirecTV unless that has changed recently. This mode was originally put in place to support casting content like Spreadsheets, and Powerpoints in meeting situations, and while it works for video, like I said it may not be the best. ..but if it's all you have then there you go.

Streaming (Casting): This is the mode where the application you wish to stream has built in chromecast support (Many do) - the little cast icon shows up as part of the application (Netflix, youtube, SiriusXM,...). This is the mode I was referring to in my first post. When streaming, the controling device (laptop or phone) simply acts as a remote control, and it sends the stream info to the chromecast, and the stream is handled by the chromecast. This is the best mode for streaming content (and primary intended mode for media) in that the content only moves between the streaming servers and the chromecast. (Server->Chromecast), and is of the highest quality. However, in this case the chromecast device and the controlling device (Laptop or phone) must be on the same network and if a VPN is required, the same shared VPN.

Yes, you are correct, you can not install a VPN client on the Chromecast. I used the term 'behind' above when I was referring to the VPN. As you pointed out in your edit above BOTH devices have to be on the same network. So even if you could put a VPN client on the Chromecast, it would not work - which is why you can't. VPNs are not a simple discussion in that there are a lot of ways to set them up. I'm crazy, and I usually carry a travel router with me - I setup my own Wifi network with it, put a VPN on that router, and then connect that router to the hotel or villas Wifi. Then EVERYTHING that I attach to MY Wifi network is 'behind' the VPN and on the same network. I am not recommending that, just saying that is what I do. The VPN server I connect to is my own at home. So I have access to all of my home services and I have an encrypted VPN tunnel to home wherever I am, and my locale is always in Raleigh. Like I said, I'm crazy, but you know how engineers are - if you can do it, then why not.

The point to all of this is that yes, you can mirror when you cast - with DirecTV that is likely your only option. It's the simplest - in this case, and mostly works -- just understand the limitations.
For those of you Roku users - conventional casting does not apply at all, but they do have something called "Play on Roku" which is the same as mirroring in Chromecast - with the same limitations. ...and they do not support a VPN on device.

Hope this helps a little.