"There is no way to deny internet access to a specific app that supposedly ‘needs’ it."

There is a way, which I employ to great success: don't install the app.

The SD card is a real worry, but I thought that apps are Sandboxed in a way - they might only see the files they created themselves? I would have to check - otherwise it would of course be completely broken.