Best way to block internet until user connects to VPN

I have always setup remote devices with a static DNS to our internal DNS so users were not able to use the web until they connect to our VPN using the policies that we have in place. They do not have admin rights so this has worked for several years. The latest updates to our Fortigate and Forticlients are causing users to not be able to connect unless I set the DNS to auto obtain. I have a couple of idea for a workaround but I was wondering what others are using as a solution.

Thank you