The DNS on a router is responsible for taking a website URL and resolving the IP address and routing path which allows the site to be reached and loaded.
The VPN works on the back of your existing network, and requires that the connection be established through your router before the VPN connection can be started.
The solution here (well, the workaround) would be to block any websites you need to prevent access to using your routers' site filtering configuration, then prevent all VPNs from connecting through the router.
VPN is a pretty broad term (like vehicle, or plant), and the specific method used to establish a VPN connection can vary wildly from one application to another.
A good place to start would be to try blocking the IKE protocol which is used to establish a secure IPSEC tunnel.
IPSEC creates an encrypted connection between two end points, and all data sent over the connection is routed through this tunnel. It's a safe bet that if you are connecting to a VPN, IPSEC is probably the mechanism used to provide it (although to prevent the barrage of corrections, I am fully aware that IPSEC is not the only way this could be done, it's just pretty likely).
IKE (Internet Key Exchange) is the protocol used to securely swap encryption keys used to encrypt the tunnel. Block that, and you stop the tunnel being established.
IKE uses UDP port 500 during stage 1 connection, so blocking this port on the router's firewall may be sufficient.
It is possible to get around this, but with all network security concerns, it's a matter of balancing the risk against the effort of implementing a solution.
Blocking the port should be enough to stop most people from connecting to VPN, and would be sufficient for a home network certainly.
As an extra level of security, you can enable MAC address filtering on your router so that only known devices can connect wirelessly.