How can I prevent any automatic unsolicited network connections?

How can I prevent any automatic unsolicited network connections in Kicksecure (at least temporarily), especially at system startup and when enabling a network connection?

At the very least, I would like to first put the whole network connection behind a VPN, notably to hide Tor traffic (generated by the secure NTP and the update check) from my ISP.

I can’t put a VPN on my router, so I have to enable it using the VPN’s software, but that requires connecting my PC to the internet first, (which generates Tor connections by default).

At the time of writing, this is unsupported.

Same replies as here:
Outbound traffic security: Kicksecure and Qubes

Related:
Kicksecure Firewall