Little Snitch (a highly customizable firewall for macOS) has the functionality you are looking for.
First create a profile for a VPN connection. (allow all in/out traffic) Then create a second profile, which would block all in/out traffic. Lastly, set-up automatic profile switching based on the current state of connection to the VPN server.
Check out this guide for more info.
Once you’ve got Little Snitch’s automatic profile switching enabled,
it will prompt you to choose the appropriate profile when you join
foreign networks. You should obviously choose your untrusted profile.
For both your known trusted networks and your VPN connection, you
should configure the trusted profile to be selected. Once you’ve done
this, all the pieces will come together. When you are on a public
network, you can select the untrusted profile, and it will block all
traffic until you establish a VPN connection. After that, it will
automatically switch over to your trusted profile.