On the configs I've seen, "killswitch" is a few lines that tell iptables to stop sending when the connection drops. I don't know how tunnenblick does it, but this might actually, and I'm not joking, be a job for applescript? Since it looks like wireuard doesn't do killswitch on its own. http://krypted.com/mac-security/command-line-firewall-manage... might be a starting point.

Connect-on-demand does what you want. OSX will use this connection when it needs to network, and if it can't make the VPN start, the connection will stall.