OpenVPN or WireGuard, or something else?
USB 802.11ac is dicey in general. Not something that I would recommend for AP at all.
I've got two GL.iNet AR750S units that I'm very happy with. One runs GL.iNet v3 firmware (close-to-the-tree OpenWrt), the other is on my bench for the ongoing saga of getting the ath79 SPI NAND PR reviewed.
I've benchmarked it at around 40 Mbps WireGuard with SQM active, 10 Mbps for OpenVPN with SQM active. Higher rates are possible without SQM at the expense of significantly higher latency. Those numbers are probably around what you can expect from a current, upper-range, MIPS-based device.
With the reasonable cost of USB-output, external, cell-phone battery packs, that would be my suggestion over something with in-built batteries.