Allowing internet access only via VPN when offsite

Hi folks,

want to implement a policy where users are not able to access internet if they are not connected to vpn when they are in a public place.

once they are on vpn, they are able to access intranet and internet, but if they are not on vpn they wont be able to access any internet sources.

wondering what implementations can be used to introduce this policy and what sepm can help on this?
kindly let me know also if there are real life cases implementation articles on such scenerio. 

thanks!