FYI: NetGuard is an open source rootless firewall for vanilla Android which also allows per-app network access control, for those unable or unwilling to go with other OSs. Works by leveraging Android VPN to block instead of tunneling packets.

Doesn't running as a VPN mean it's incompatible with running an actual VPN at the same time? That's a pretty big caveat.