GrapheneOS has Network as an Android permission, that you can grant/revoke per app