I'd approach this from the router. If you give the device a static DHCP lease, then you can block it from 0.0.0.0 and allow it to your VPN provider's IP blocks

I'd approach this from the router. If you give the device a static DHCP lease, then you can block it from 0.0.0.0 and allow it to your VPN provider's IP blocks. You might want to give the device its own WiFi network if you don't trust it to honour DHCP