You can not ensure all traffic is protected. You also can't easily block traffic while waiting for VPN to connect, authenticate and secure without having two OS running:
VPN requires an open Wi-Fi connection to be built before it can reach out over that open/hostile/insecure Wi-Fi connection to secure a limited portion of the traffic leaving your Mac.
In other words, you have asked how to only drive on a freeway from your garage without using the driveway or surface streets. Once you're on the freeway, you can stay on it and not get off, but you need the streets to get there in the first place. Worse, VPN only obscures the windows of your car so things that are packed inside have some more expectation of privacy from casual observers.
On a practical level, you can set your Wi-Fi to never save a joined network or meticulously set then to never Auto-Join so you have control over each and every untrusted Wi-Fi connection and can ensure no apps are broadcasting before the VPN tunnel is established.