It can be configured to automatically connect before you even log in, so you’re never "unprotected" on public networks. Smart Reconnect:
: Supported Multi-Factor Authentication (MFA) via SAML 2.0, RADIUS, or certificates, and offered split-tunneling to optimize network traffic. The Critical Deadline: End of Support
But more elegantly, configure the ASA group-policy to set split-tunnel-all-dns enable (forces all DNS queries through the tunnel).