how can I prevent apps from immediately connect upon wifi connection
Since Android 8 there's built-in option Block connections without VPN in VPN settings.

In other case you may use AFWall+ (root required) from F-Droid or Google Play to allow apps to connect to internet only through VPN (only paid version supports VPN).