GrapheneOS has "Network" as a permission you can disable per app like any other permission. This is such an obvious and purposeful omission in stock Android's permission model.

I see NetGuard was mentioned in a comment, but if you have Graphene you can just install an app and never let it call home via the App Info permission menu. I do it for Google Camera and Snapseed, the few non FOSS apps on my phone.