Is there a way to prevent users from uploading files when they are on external networks? The reason for this is internal security and protection of company confidential documents. They should be able to access our VPN services, and then they could access the internet using our Firewall rules. Is there a way to do this without any third-party MDS software? I am thinking GPO policy, PowerShell with Task Scheduler and other Windows tools and services.
Configuring conditional access would be the golden bullet. I linked to the Azure documentation, but on premise you could reach the same by configuring your firewall, allowing all the internal networks, except the VPN services.
You can configure a Always On VPN on your VPN server. With this you will be able to force users to connect to internet thru your network with your firewall rules.