Here's a detailed explanation from my initial comment. The goal is to learn what is the equivalent using the CLI tool nmcli without having to browse through all the documentation to pinpoint a setting as long as it's known by the user on the GUI tool: with the temporary help of this GUI tool nm-applet, which has to be available somewhere (not even the same system) with an equivalent setup. This is just a generic method which could be used for any other setting than the one considered here.
There are two connections involved: I'll call them main, and myVPN which is to be automatically connected when using main. Here the change will be done on main, that's the one which must be examined.
$ nmcli connection show
NAME UUID TYPE DEVICE
main cfa5be23-925a-4273-b5de-2f9adaac8782 wifi --
myVPN 0d9e60ef-6b5e-4f65-8312-8db428589866 vpn --
To display the configuration of main, either of these (and probably more shortcut versions):
nmcli connection show connection id main
nmcli connection show connection uuid cfa5be23-925a-4273-b5de-2f9adaac8782
will dump among many other lines something like:
So first dump all of it in a file. Some of the output is localized, so better do
export LANG=C.UTF-8 before (if later a specific setting name or value should be searched or compared on internet this would help):
nmcli c show id main > /tmp/before
Using the GUI tool nm-applet where the feature is known, the VPN myVPN is added to main:
Dump it again:
nmcli c show id main > /tmp/after
diff can compare and show what changed:
$ diff -u /tmp/before /tmp/after
--- /tmp/before 2019-05-04 10:47:43.410149358 +0200
+++ /tmp/after 2019-05-04 10:47:58.798252044 +0200
@@ -15,7 +15,7 @@
connection.autoconnect-slaves: -1 (default)
So that means the previously inconspicuous setting
connection.secondaries got set, without too much trouble to guess, to myVPN's UUID:
0d9e60ef-6b5e-4f65-8312-8db428589866. nm-settings(5) tells about it in connection setting:
secondaries array of string 
List of connection UUIDs that should be activated when the base
connection itself is activated. Currently only VPN connections are
You can now clear again any automatic connection to VPN on main with:
nmcli c modify id main connection.secondaries ''
and add again myVPN with (it's an array, hence
nmcli c modify id main +connection.secondaries 0d9e60ef-6b5e-4f65-8312-8db428589866
With some glue code (retrieving uuid from id etc.) this can now be automated.
Of course the corresponding line is added or removed in a file somewhere in
/etc/NetworkManager/, but this should not be relied upon.
NB: I didn't know about this setting before writting this answer, I just did what I told.