You can use iptables to do this, probably. At least if "goes over the VPN" is something that iptables can see, for example, its a separate tunnel device. Assuming the vpn is device "vpn", something like:
iptables -P OUTPUT DROP
iptables -A OUTPUT -o vpn -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p udp --sport 68 --dport 67 -j ACCEPT # DHCP
# "I Agree"
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT # DNS/UDP
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT # DNS/TCP
iptables -A OUTPUT -p tcp --dport 80 -m owner --uid-owner your-userid -j ACCEPT
The last three rules are to allow you to get to the "I Agree" webpage. After you've clicked the "I accept" button and your VPN is up, you can get rid of them. Note that its possible for some stuff to leak out during that period, in particular DNS lookups. Avoiding that is much more difficult.
(Untested, I suggest having wireshark installed and running to debug if need be. I'm pretty sure its right, but am least confident about that DHCP line. It may not allow enough... If you don't get an IP address, that's what's wrong)