September'25 updates: https://muntashirakon.github.io/blog/2025/10/18/september-updates/
TL;DR From Android 13, you have the ability to block networking for a UID using BPF:
cmd connectivity set-package-networking-enabled [true|false] [package-name]
For the firewall to work, you may need to enable chain3:
cmd connectivity set-chain3-enabled true
The drawback is it gets reset on reboot.