I do not believe iOS has a way to configure an always-on rule; I would recommend checking with AirWatch for that.
You may be able to simulate that by setting the Safari domains to be sites users will typically have open/reach out to (e.g. google.com) or you may be able to set a domain-based rule to always connect for your email server (if you allow ActiveSync).
