Damn, Astrill is expensive though. Friend in China is currently happy with Mullvad + Shadowsocks. A few hiccups here and there, but it works pretty well and is fast enough for streaming, too.
They also have guides to a few more involved methods in case Shadowsocks is blocked.
This is the correct answer. If you don't need notifications:
Make sure you enable the auto frost service in Shelter's settings, enable auto frost for WhatsApp in Shelter and replace the icon on your home screen with a Shelter shortcut.
You can also use a trustworthy VPN to route traffic from the entire work profile or only from WhatsApp.