Managed Network - Failed to set mTLS

We’re using profiles with managed network. The WARP clients correctly disconnects/doesn’t reconnect when joining a managed network but I’m not able to prevent a user from trying to connect. When it does, it shows an error “Failed to set mTLS”.

How can I prevent a warp client from enabling the tunnel when they’re on a managed network?