They shouldn’t be able to bypass much if you have visibility conditions on your tabs. Have a value in you user profile that’s only filled when when onboarding is completed. Then use that value to control tab visibility. At most they could still open the menu, but with no visible tabs, they can’t navigate anywhere.
Is there certain functionality or components on the user profile screen that you don’t want the user to access? You could use the same ‘completed’ value to control components or entire containers on that screen. You could also use that same value in a condition to show a hint component saying that they need to complete their profile. Basically lock down anything in that user profile screen that you don’t want them to see.