In Cloudflare's case they specifically do tunnels on port 7843. Just block TCP/UDP outbound on those pots and CF Tunnels won't work.

See: https://developers.cloudflare.com/cloudflare-one/connections...