Use network namespaces :)

A brand new network namespace doesn’t have any network interfaces. When you start a process in a namespace, all its child processes will start there too. It’s like a little network jail, and the functionality is baked into the kernel / is kernel enforced.

I use this to keep certain processes on a vpn, with no need for interface-binding support from the process, or a vpn-killswitch.

Another fun fact, this is the functionality that enables containerization, like docker/podman

First Solution Works

Also:

Firejail

eta: Firejail is available in most distros' repos.

The last reply in THIS thread includes a simple bash script to launch restricted apps.

Heres my lazy and probably stupid way (im a nub btw)

1. Only install flatpak apps.
2. Install flatseal and manage every app using that.

Cons: might be a problem to manage if you got like 1000+ flatpak apps installed