In your scenario service1 will not have it’s own network namespace, it will be hooked into the network namespace of service2. So however the network configuration for service2 looks like is what service1 will be using as well. Even localhost will be the same localhost on both containers.
The network namespace will be owned and managed by service2. If you plan to publish ports for service1, they need to be published on service2. The same is true if other containers should join other container networks, all of this must happen on service2.
In this scenrio people use the vpn container as main service and configure every service that should use the vpn connections with network_mode: service:{service name of the vpn service}.