If I understand, you want to prevent qubes using the VPN NetVM qube to do networking when the VPN is off?
You need this: