When you first connect to some websites, they require that you give them an email address, or some other piece of data before you can use their service, this page is referred to as a captive portal.
Your company laptop is setup so that when it detects an internet connection, it connects back to your corporate VPN, and then connects back out from there. In most situations, (scenarios 1 and 2 in your question) you can connect to the wifi with a password, or open wifi, tunnel into your corporate VPN, and then connect back out - all of which is done using the service of the wifi you are connecting to.
However, in situation 3 - you may land on a captive portal web page, which requires that you enter some piece of data first in order to connect. However, your laptop is designed in such a way that you must connect to the corporate VPN first. Which means that you can't connect to the VPN because you haven't entered any credentials on a captive portal, and you can't enter the credentials because you haven't connected to the VPN yet.
Hopefully this answers your question a little better than my previous comment. Leave a comment here and i'll update this if you have further questions.
edit: Just to add the reason why a company might have this type of set up is because they can ensure that all traffic passes through their VPN, and allows them to enforce other policies, ie. Acceptable use, etc. Please see @gowenfawr answer for more info above as he has explained it extremely well.