I'd do the reverse, block any internet access unless it's over a VPN gateway. Additionally, block anything by default that wasn't looked up over my DNS proxy a

I'd do the reverse, block any internet access unless it's over a VPN gateway. Additionally, block anything by default that wasn't looked up over my DNS proxy and/or uses HTTPS without SNI...