To block network access: firejail, unshare, or ip-nets jail if you like to get your hands dirty.
To limit bandwidth you can use trickle, wondershaper or again use ip tools.
If you don't mind some work SELinux can do this and so does AppArmor which is probably already included in your distro.
Note that Linux has application firewalling built in as part of kernel namespaces.
Edit: forgot to add, new application containers such as snap have a built in system for this and more - just like how its done on phones.
I'm thinking of a situation where I want to run a precompiled binary, but only want it to talk to an other container and not the outside world. How would I do that?
docker run --network=none x
docker network create --internal int1
docker run --network=int1 xyes, and not many of them allow inspection on the level that i am interested in.
for example, counting bandwith per interface when i really care about speed and accumulated bandwith that goes the ISP.