One of the methods that could block internet access on a per application basis is "sandboxing".
Often network access to/from applications is indirectly controlled using firewall rules. It normally happens that an application tries to communicate in a consistent way (either to a specific port/address, or from a specific port/address), and with a firewall you can prevent access to/from a specific port or address in an effort to disable the application's ability to access the internet (or some other computer). However, if an application doesn't communicate in a consistent way it would be very difficult to write firewall rules you were certain blocked all of its networking. It's also possible that an application that you want to work also communicates using the same port/address, and a firewall would likely block both applications.
Sandboxing is a general term for any strategy meant to create a separate environment for an application. One of the common reasons for this is to be fully aware of what the application is interacting with, because by default normally the application cannot access anything outside of its "sandbox" unless you specifically allow it to.
I won't describe a full-on setup, but software like Docker and Kubernetes were designed with exactly this in mind; you can allow as little or as much network access to the software running in their "containers" (aka, sandbox).
Needless to say, it's a lot more work to run everything inside a container, but if there are a few applications in particular that you're concerned about it could be worthwhile for them.