Or you can just use a different device. There's plenty of hardware/software that respects your VPN routing rules, Apple is the outlier here. You don't need a complicated racked-and-stacked Ubiquiti when kernel-level WireGuard will do the trick.