You can disable Google Chrome auto update via a Config Profile:
https://learn.jamf.com/bundle/technical-articles/page/Disabling_Developer_Auto_Updatesfor_App_Installers_with_Configuration_Profiles.html

It's just a configuration profile. Set the payloads you want and deploy. You can blacklist certain extensions or set the browser to only allow managed extensions to install. Google has managing Chrome fairly well documented; you can use configuration profiles or manage chrome directly from googles admin console. 

Set Chrome app and extension policies (Mac) - Chrome Enterprise and Education Help (google.com)

This is an example of a configuration profile we use. It forces these 3 extensions, and due to the key, it blocks the installation of any other extensions.

We manage our Chrome browsers via Google Admin Console / Managed Browsers. It's free and gives you total control - for example we block all Extensions and only allow ones we approve. I won't bore you any further but there's literally thousands of options available.

You deploy an enrolment token via a Jamf Config Profile then Google Admin takes over.

More info here:

https://support.google.com/chrome/a/answer/9116814?hl=en

https://chromeenterprise.google/intl/en_uk/browser/management/

I'll also point out that VPN's can be stopped at the network level using a web filter that targets all connectivity points on the client. Be it Jamf Safe Internet, Securly,  or Lightspeed(🤢). Basically any that use a pac file or dns proxy. 

That way you get a belt and suspenders approach with extension whitelisting using Chrome Management.

Thanks. That is very helpful.