I use Marcel Bokhorst's excellent Netguard app (https://www.netguard.me/ https://www.netguard.me/) on unrooted Android devices as a firewall and have it set to

I use Marcel Bokhorst's excellent Netguard app (https://www.netguard.me/ https://www.netguard.me/) on unrooted Android devices as a firewall and have it set to "deny" as a default, so no newly installed app gets network access. If an app does not work in this "offline mode" I inspect what it's trying to do as Netguard maintains a log which one can even export in PCAP format for further processing if needed. BTW, even my wife and other family members, all classical end users, can easily handle Netguard after a short introduction.