You can't do what you want as VPN Mgr has no idea what's going on until it's too late and the stream has started.
You can set up a button on the remote to switch the VPN connection. If you have one connection then it'll cycle between enabled and disabled. If you have multiple connections it'll move through them. If you wanted a dedicated enable/disable, then you could map a button to a VPN Mgr API call but that might need you to do some low level stuff to make that work.