Requires no Internet permission, works by running as a local VPN service, can block Internet access of any Android app (including system apps).

Karma Firewall can be installed from F-Droid (it's not on Google Play): https://f-droid.org/packages/net.stargw.fok/

Been running it for ages, it's on this Android I'm using to send this and it's reliable.