An always-on VPN can be set for your profile, with an option to disallow networking when the VPN is not connected.
Use with Disallow Config VPN policy to prevent modification of this setting manually from the device.
You can find this configuration in the Configuration tab of your profile.
Notes:
- You must first add your VPN app to your profile, before seeing it listed in the dropdown list above. Check out this article for adding apps to your profile.