You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to comp

You can make it more difficult, but short of actually disconnecting China's network from the rest of the Internet entirely I don't think there's any way to completely prevent it. I had a run-in with a particularly aggressive captive portal last week that kept injecting ads into unencrypted pages (if I'm traveling on one of your vehicles, I don't want to buy tickets to travel with you), but fortunately didn't firewall outgoing port 22 so I could use sshuttle to route 0.0.0.0/0 via an SSH connection to my personal server. This works with pretty much any server you can run Python on, so I don't know of a good way to stop it unless you're willing to block anyone from SSHing outside of the country (thus preventing e. g. Chinese companies with a global market from running servers in other countries).