Disabling the VPN stops it until the next boot, doesn't it? Perhaps it needs to be mask'd?

sudo systemctl mask [email]openvpn@openvpn.service
which will prevent it from starting until you...