This seems like something that would be simple, but I spent a long time trying to figure it out. I figured I'd write a blog post about it in case anyone else has a similar desire.
On BSD you use FIBs to declare process specific routing tables, on Linux you use firewall marks to do the same, then just route all trafik through the vpn uplink and deny any other.