Rethink DNS can block internet access of an app (besides doing DNS-based blocking, etc.): https://rethinkdns.com

It uses the VPN functionality, but you can stack a Wireguard VPN on top of it.