Block clients from creating VPN

I know it never will be 100% effective. But I want to block clients on my GREEN network from establishing there own VPN to get around the protections I have in place.

Anyone have an idea how I can go about this?

I was going to start with blocking most VPN services’ via DNS (PiHole) but I am wondering if there might be some additional ways I can accomplish this also?

Thanks in advanced for any ideas!

Change default firewall policy to block
Force users to use proxy