You can do this with any VPN app that allows for split tunneling. Like Mullvad VPN.
Enable the VPN, go to system settings, and set always-on VPN, and set all apps MUST use vpn. Then configure whatever app you don’t want to have internet access in the VPN as the split tunneling.
So if you make chrome split in the VPN, but the OS requires all traffic to use the VPN, then chrome will have no internet access.
This is all fine and good, but complex and easy to make mistakes, better to use Graphene or Calyx which makes this a first class feature