See my comment elsewhere in the thread about using your normal network setup, but inserting a "slug" that only allows your VPN port and/or endpoint(s).

Since the slug is invisible, and has no IP address, and runs no daemons, etc., the only misconfiguration possible would be the initial one.

Once the slug is in place, there is no more "accidentally didn't use the VPN..."