Our network prevents anyone connected to the VPN from sending or receiving traffic through the firewall, and forces users to send all traffic out the VPN connection. It's the most secure way we've found. Granted, it means that you can't get on the internet when on VPN, but that's kinda the point, isn't it?