Comment by ComputerGuru

Any “always require vpn” option is a game of cat and mouse and is going to leak traffic at some point, whether easily detectable or otherwise. As others have said, you need to set up a secure environment that only has that one and only option for accessing the outside world.