don't connect these to the internet that's how it was done

That's effectively what "require a VPN" means. You can simply block any connection that doesn't come through the VPN.