Hello @PolkaDotMom
This is complicated, and Google doesn't formally describe exactly how this works under the covers. But, from what I can tell, the blocking appears to be done almost entirely by stopping blocked devices from resolving hostnames to IP addresses via DNS, but does not stop existing connections from carrying traffic. It's possible it also stops initiation of new connections, but if so, that might only apply to TCP connections, not the newer HTTP/3 connections that run over UDP. Many VPN solutions run over UDP, so it's possible they are not blocked by this pausing feature at all.
Worse yet, if it is mostly DNS-based, newer devices often use their own DNS resolution solutions, which can make this largely ineffective at all.
All of that may be more technical than you care to dig into, but the result is, "pausing" is not a perfectly effective method of stopping a device from connecting to the internet (and even if it was, it doesn't block devices from connecting to other devices on the local network).
So, I'll try to answer the numbered questions as best I can:
1. See above for why devices may not be blocked by the pause feature, especially if they are doing their own DNS or using a transparent privacy feature or VPN.
2. I'm not aware of any way to block VPN usage.
3. If these are devices you no longer want to have access to your network, then you have two options. A) If you have access to these devices, remove your network credentials from them; B) Change your primary network credentials and use a guest network for any devices you want to have temporary access.
