You can also do this by simply removing the default gateway from your network configuration all together. Then set static routes on your system for the VPN server IP address(es).
In essence you remove the ability of your computer to communicate outside the local network, but you have told Windows how to still find and connect to the VPN server.
If you want normal access again, simply re-add the default gateway IP address to your network configuration.
A sample command for adding the VPN server routes would be:
route -p <vpn server IP> mask 255.255.255.255 <default gateway IP>
The persistent routes you create can stay. All you’ll have to do is add or remove the default gateway from the network interface. You can also script this with the netsh command and put a shortcut on the desktop to click to turn ON or OFF normal unprotected internet.
To add/remove a default gateway IP you will have to choose a static IP address rather than using the “obtain automatically” setting in your network configuration.