I've got a school district Customer who has a wholly dissimilar requirement. I should have read your question and the discussion surrounding it more closely.
We're opting to go the route of a dedicated SSID back-ending in to a VLAN w/ firewall rules to direct HTTP traffic to a transparent proxy. That limits our need to do any configuration in the iPod and iPad devices themselves since they have such a limited "enterprise" configuration feature-set. This also lets us control the traffic coming from the devices to prevent use of "rogue" proxies or VPN connections.
re: Physical security - We're treating the devices as completely untrusted, and isolating them to communication with the Internet and DMZ services (HTTPS to the WebDAV server, etc). A student certainly could "jailbreak" the device, so we're just assuming they're untrusted.
Edit:
My Customer's requirements related only to filtering content when used on the District's Internet connection. We couldn't care less (rightly or wrongly the District's lawyer says this is fine) what content the devices access when used on a non-District-controlled Internet connection.
Clearly, I'm wasn't reading this right (and am an idiot... >smile<).
You're saying that, irrespective of the type of Internet connection in use, you want all traffic to be sent to a proxy server. You could try to force an on-demand VPN connection, but I would suspect that you can't specify no domain name (page 35 of the enterprise deployment guide that Zoredache linked to) to match (effectively matching "*"). I don't have any of the enterprise deployment tools handy right now so I can't check that. I'd love to hear if you give it a shot and it works.
Assuming that you do force a VPN connection, though, it would be fairly trivial for a user to cause the VPN connection to fail (settings in their home router at layer 3, or in their DNS if you're connecting to a VPN server by name) and the device would, presumably, function without a VPN connection. You'd need to test that.
I think you're looking for a garden with higher walls than the one that Steve and company built.
Best Answer
There is no official support for OpenVPN on iOS. So unless you want to Jailbreak all your devices, there's no way this is going to work.
Instead, you could setup an IPsec VPN using tools like strongSwan or by buying a commercial appliance. An entry level Cisco ASA isn't that expensive, even more so when considering the time it takes to set up and secure something like this yourself.