avanguardo but the next reboot it starts again and I have to kill it manually.
Don't see how that can happen. rcctl disable openvpn will remove openvpn from pkg_scripts (and also openvpn_flags=) from /etc/rc.conf.local so on the next boot openvpn will never be started--you can check this by looking at the startup messages. And, rcctl stop openvpn does stop the service in the current session. Just checked all this on 6.9.
Of course, for rcctl stop to work openvpn has to be started with only the command line specified in openvpn_flags=. If you run the server with any other flags, then rcctl stop won't work...