There are actually two default firewalls. The firewall that's configurable in UI can only block inbound connections but not outbound connections. The other firewall (pf) doesn't have the concept of application so one cannot allow one app to access a remote IP but block another, and I also don't think it supports DNS.
As others have indicated, LuLu (like Little Snitch) notifies you when your machine is initiating an outbound connection and lets you grant or deny permission, and to set up a persistent rule for that app/connection.
The built-in firewall is only for incoming connections, not outgoing connections.