How to disable access to i-no when VPN is disabled?

Question

openvpn

Task:
1. Disable and-not on the server when the VPN falls
2. Leave access to connect via RDP from an external static ip address.
OS: Windows Server 2012 R2
VPN deployed on vds (debian) using the package
Tried blocking through "OpenVPN Protector" from safe-inet.com, but it says "Only one connection is used. OpenVPN protection is disabled." VPN rises, but protector does not start.
I tried by changing routes, dug up in the Internet, but there is no experience - it doesn’t work .....

Answer 1

Option 1 - remove the main gateway (i.e. there will be no more Internet), add a static route to enable vpn
Option 2 - remove Internet access on the gateway, give only access by port (vpn)

Answer 2

I did 1 option,  deleted the route of the main gateway, but after a while it appears again in the route table .... how to delete it permanently?