> disable network access entirely for some apps

NetGuard can do this via "local VPN" on GrapheneOS/Android, https://netguard.me/

iOS Lockdown app provides device-wide adblock by destination host, but not per-app outbound rules.

1Blocker lets you run a local VPN for iOS. It's defaulted to in-app trackers. But you can also just bulldoze all of an app's endpoints.

> bulldoze all of an app's endpoints

https://support.1blocker.com/en/articles/9720640-how-to-enab...

Does the user need to add endpoints manually for each app, after identification by Charles Proxy?