Or if you’re running qBittorrent (either the full version or the server-only one which is probably best for a server machine) you can just bind it to the network device of the VPN (in Tools->Options->Advanced->Network Interface) and it will only ever run over that interface.

This actually makes much more sense in a Pi since the qBittorrent server-only version installed directly without a container is way lighter than the Docker version and can be managed remotely via a web interface.