The best solution is running the VPN client in your router. That way, your machine can't see its ISP-assigned public IP address.

If you're using a workspace VM, you can run the VPN client in a pfSense VM, which is functionally equivalent.

If you're not using a workspace VM, and can't run the VPN client in a router, you can run the VPN client in a pfSense VM. You bridge the WAN interface of the pfSense VM to the host LAN adapter. So then the host can't use it. And you configure the LAN interface of the pfSense VM as host-only. So now the host machine (your workspace) can reach the Internet only through the VPN client in the pfSense VM.

Or you can just make sure that WebRTC is disabled.