It's really not related to Tor, or how Tor works at all ...
However you could use it with Tor in just the same way - your Tor-networked device should be talking on only specific network ports and any other "chatter" should be considered a leak ... so you would configure the "slug" to only allow the Tor-generated traffic on the expected ports.
I do not use Tor and don't have specific ports/protocols information on it ...
In my opinion, it's best to use Whonix for Tor, because the Tor process and userland are in separate VMs, or separate Qubes AppVMs. There is no forwarding at all between the Whonix workstation VM and the Internet, via the gateway VM. The workstation VM just uses Tor SocksPorts exposed on the gateway VM, through a private network link.
Where leaving no traces on a device is key, Tails is better, because it runs in RAM and wipes everything during shutdown.
However you could use it with Tor in just the same way - your Tor-networked device should be talking on only specific network ports and any other "chatter" should be considered a leak ... so you would configure the "slug" to only allow the Tor-generated traffic on the expected ports.
I do not use Tor and don't have specific ports/protocols information on it ...