prevent Mail from checking for mail if VPN is down
Have your employer block access to the IMAP server from non VPN connections. That way Mail can check all it likes but it won't get anywhere. As long as Mail is using a secure connection for the IMAP server it will reject most any nefarious attempt to hijack the attempted connection.