You do not need to know "reliably". You can block everything remotely suspicious, and in case someone is blocked by mistake, they can file an application with all necessary documentation proving the connection is not a VPN.
Let’s block traffic on the internet blindly just in case someone is looking at an adult website.