[justsomehnguy]

> in particular when the app does need to make some web requests to operate

A web app doesn't need to make an outbound web requests to operate. A user interacting with a web is the one initiating the requests.

You can give the access to the up through a HTTP proxy and you can filter out any outbound requests from the web app or even not configuring the network routing for the server hosting that app. That leaves you with only JS initiated requests in the rendered pages of the app.