What I've done is make sure all certificates going through the web proxy are validated, the only DNS resolvers that can be used are the internal ones with additional DNS filtering, and any traffic that isn't HTTP, HTTPS, STUN, Video Streaming, iTunes, etc. is limited to 250-300kbits/s (compared to our soon-to-be gigabit connection). I also have "Log-on Hours" set in AD which works quite well with BYOD as the kids' devices will flat out disconnect after 22:00.
It'll get so frustrating for the kids that they'll just stop using their VPNs, while legitimate users will notice no difference. We're also in the middle of nowhere with thick walls so 4G isn't an issue.
After a few months of running reports on the type of traffic going through the firewall, VPN usage (e.g. 30GB on "DNS" or "NTP" per night) has shot right down.
It might be very overkill, but it works.
