Kudos for getting the relationship of the glasses correct.

bind the client, but also be sure that it’s locked down to force everything to go through the VPN as well

preferrably with a VPN that will continue blocking traffic even if the entire VPN client is closed

This, except Usenet.