Yes, there’s many ways to make programs unable to use other network interfaces. E.g. I’m creating a network namespace with a single wg0 interface, which I make services use through systemd NetworkNamespacePath.

That said, I’d argue gluetun is pretty much foolproof, especially with most people using docker which messes with iptables.