save this as /etc/dhcp/dhclient-enter-hooks.d/no_default_route and chmod +x it

script.sh

#!/bin/sh
# prevent dhclient-script from setting any default route
# except for ens6, which is our public interface

INTERFACE_DEFAULT_ROUTE="ens6"

DEBUG_FILE="/tmp/dhclient-nodefroute.debug"

echo "Interface ${interface} entered DHCP because of $reason." >> $DEBUG_FILE

case "$reason" in
  BOUND|RENEW|REBIND|REBOOT|TIMEOUT)
    echo "New DHCP conenction for interface ${interface} because of $reason." >> $DEBUG_FILE
    if [ ${interface} != $INTERFACE_DEFAULT_ROUTE ]; then
      echo "${interface} doesn't match ${INTERFACE_DEFAULT_ROUTE}, not setting default route." >> $DEBUG_FILE
      unset new_routers
    else
      echo "Allowing default route for ${interface}" >> $DEBUG_FILE
    fi
  ;;
esac