The simple solution is to use Little Snitch: https://www.obdev.at/products/littlesnitch/index.html
Little Snitch is great for when I want hyper granular control of a specific app's network permissions while Radio Silence gives me a super quick way to just block EVERYTHING for a particular app right away without even opening it the first time.