An alternate method, if you’re unwilling to give up all control over Internet-bound traffic, is to enable only services known to be safe to circumvent the VPN. Microsoft has encouraged its customers to take this approach to optimize Office 365 traffic, and provides an API for identifying MS service endpoints, which you can query with a PowerShell script.