On a standard Android device, the OS will prompt the user to approve VPN access for an app on its first connection attempt, then remember that decision indefinitely.  If a user wants to revoke VPN privileges from an app, he can navigate to Settings -> ... More -> VPN -> <app_name> -> Settings gear -> Forget VPN.

This flow does not currently work on Chrome OS because the "... More" menu is disabled.  I don't think there is another way to revoke access.