At the OS level LineageOS offers per-app network permissions, which I've used and functions as expected. One quirk from what I understand of this ticket[1] is

At the OS level LineageOS offers per-app network permissions, which I've used and functions as expected. One quirk from what I understand of this ticket[1] is if there's a proxy set up via a separate internet allowed app it can bypass the restriction via that app. GrapheneOS' implementation is said to prevent this. [1] https://gitlab.com/LineageOS/issues/android/-/issues/3228 https://gitlab.com/LineageOS/issues/android/-/issues/3228