Thank you for clarifying! This looks a bit weird, that user can't manage it by itself(
Maybe could you suggest if is there an app which can take .mobileconfig and add the profile encoded in there as "personal vpn"? There is Brooog IKEv2 app that does such thing, but only with EPA (username/password) credentials, but Libreswan VPN server doesn't offer this ability sadly(