You can force all new devices to use a protected VPN connection as soon as they connect to the network. Each time a new device is discovered, it will be added to the Unsorted devices group.
In order to protect a new device, this group must be connected to a VPN tunnel. You need to select a VPN provider in the Pick VPN provider box, specify a region, and then click Connect:
All traffic will then be routed through a protected VPN connection.