Exactly, the client creates a vpn connection to communicate with the relays. We could say that the relays act as coordinators.
I wonder if it's not possible (and better) to use Keet/holepunch rooms powered by DHT as a more decentralized way for coordination, instead of Nostr relays. I can't help but be wary that relay operator will be (forces to) censoring joinstr events , of pressured.