Different Profile based on IP?

Is it possible to apply a different NextDNS profile if the device is coming from the Office vs the VPN?  My use case would be 100% Windows devices and we currently use Akamai Secure Internet Access.  The goal being to essentially block domains outright if you're off the VPN which we can do without a problem now with SIA.  I'm not sure if this translates the same to NextDNS or not though?

If I push the Windows Client to all of my endpoints with the Config ID for the "VPN" location for instance, where I specify a different config than my "Office" location, will the clients automatically being behaving by the Office location if that's configured on my Firewall where the traffic is egressing, or will they maintain individual client connections out using the Config ID already set on the endpoint?  Working in a Palo Alto environment with GlobalProtect for reference.