Global Secure Access bypass (Internet and web filtering)

Hi,

I understand in Global Secure Access "365" I can use a Conditional Access Policy to block access to 365 if not from a "All Compliant Network locations" to prevent a user pausing the Client.

But If I want to use Global Secure Access "Internet" and use the web filtering, how do I prevent a user pausing the client and bypassing the restriction.

I assume this would be a Conditional access rule, but how would you prevent any/all Internet traffic bypassing the client on pause?