In that case I would simply disable the Auto-VPN of that site. There is no need to disable the WAN ports. You could also set a firewall rule that denies any traffic to your WAN. You could also script that and use the API, there you could program your red button.
... View more