You are correct that when you have two default routes in the same vrouter they get treated as a round robin and balance the traffic between the two interfaces. You have two options to setup all internet traffic going out the one and using the other for VPN.
Use policy based routing to forward the web related traffic from your internal segment to the desired connection.
Create two vrouters so that each only has one default route for their respective circuit. Then put your internal segment onto the vrouter with the circuit you want to use for the internet. And then create the tunnel to the second vrouter and setup internal routes between the two vrouters for it to reach the final destination network on the first vrouter.