OpenVPN runs on HTTPS port, and I suppose it's hard to block without DPI. If the VPN runs on a known port like various other VPN protocols do, it should be trivial to block those connections.