There is an Internet permission, and GrapheneOS allows denying it to apps that declare use of it.