I tend to use DNS66, but have been looking for an app the can also block on a per-app level. Because I agree with the web site: it is very fishy that e.g. the Calculator app would have internet access.