On iOS it wouldn’t even be that hard. There’s already a toggle to disable use of cellular connectivity. Add a separate one for non-cellular (iPadOS can connect via Ethernet), and/or a “disallow all” toggle.

We are partly there in spirit with App Transparency keeping track of the IPs and hostnames apps connect to.