Selinux can add labels to network packets which can be matched with nftables & al. Its a bit complicated tho. Since you need to add and create labels. You can

Selinux can add labels to network packets which can be matched with nftables & al. Its a bit complicated tho. Since you need to add and create labels. You can also match by owner in iptables. So you can have a network restricted user and sudo to it.