MacOS – Prevent Network Settings From Changing Automatically

Setting it in the VPN connection settings works as expected for me.

Make sure you check the Web Proxy (HTTP) checkbox (or other types of proxies if required) and fill out the correct proxy server details. You probably also need to enable "Send all traffic over VPN connection" in the VPN's advanced configuration.

Afterwards, make sure you apply the settings by clicking on the Apply button.

Alternatively, you can set up different network locations. You can add a location in the Network preference pane and configure different values for the proxies and other settings on the main network interface. You will have to manually select the appropriate location for switching settings though.

Your Mac will only automatically join Wi-Fi networks which are in its preferred networks list.

If the non-secure network is not in that list, it will not join it.

If you want to be prompted to join a network when no "known" network is available, turn on "Ask to join new networks."

However, if you do not turn on "Ask to join new networks" then your Mac will not automatically join the non-secure networks, it will simply stay disconnected without prompting you.

So there is no need to 'blacklist' a network because it will not join it unless you tell it to join it. Unfortunately there is also no way to tell your MacBook not to present it as an option. The best you can do is require an administrator password before it can be joined: