Would it be possible to skirt these policies by having a system-wide ad blocker that's only partially configured? Either the user has to modify their systems settings to use the local VPN or take some action to load or enable the blocklist.