The fact that the certificate is exportable or not depends on whether the certificate's private is marked as exportable or not and this is done with the CA server. VPN client does not have a feature that will lock down this feature, other than editing the GUI to gray out this feature.