I would run the tunnel from the local travel router (just another GL iNet one I guess) to your US wireguard server, and make sure nothing can route anywhere if that tunnel drops!

Disconnecting the antennas is undetectable remotely, but the card will still sometimes pick up signals I think. Maybe a non-conductive faraday cage/bag/material can be wrapped/taped around it to make the odds very low.

Removing the card entirely can theoretically trigger a TPM holding eg BitLocker keys to reset and make the drive unable to be decrypted without the recovery key. Save your recovery key within the OS if it'll let you. If you can't, from my research it doesn't seem like TPMs generally reset over Wi-Fi cards going missing.

Interestingly, it does look like you can monitor and change bios settings using PowerShell; however, I'm not sure someone would go through the effort to actually monitor those settings. Endpoints like a laptop are disposable to a large enough organization. They do not want to baby the devices and micromanage each one of them, if troubleshooting an issue is going to take longer then just replacing the device, they'll likely just replace it. Getting into the weeds of monitoring the bios of every end point for changes just seems like a huge waste of time. However, I could see them password protecting the UEFI, in which case cracking open the device and disconnecting the Wi-Fi module is your best bet. I doubt they'll be monitoring for that as well. Opening the device shouldn't raise any hairs because people already beat the shit out of their devices as it is.