I like this approach. Thank you.

Would it work if a user's device that is already connected to the VPN, but has custom DNS override to say 8.8.8.8 ? How can I allow my users to be able to use 8.8.8.8 DNS override and still work seamlessly?

I think you'd at least have to have the fallback DNS set to your local DNS resolver in order to get the server.internal resolved to a A record.