You can use your firewall to block all non-VPN traffic from a device, except for DNS. Or, if your VPN provider supports it, just use the DNS port for the VPN and allow only UDP 53 outgoing (e.g. Mullvad). Besides that, very tricky thing to check. Always rely on multiple layers of “protection”.