If I set up an always on VPN that blocks all communication without it under the owner profile, then create/switch to a secondary user, will it also use the same VPN and have the same restrictions? Is there a way to force this if so?

VPN is per profile: you must configure VPN for each profile.