Block a package's internet access

I’m a new Nix user, running NixOS 24.05 (no flakes/home manager yet). In my previous setup, I would firewall some applications to block all network access (e.g., revoke internet access of a flatpak). What would be the best way to block internet access for an application in a configuration.nix?

I haven’t used it before, but Firejail with option “–net=none” seems like it could work. However, Firejail also isolates the application so it takes a bit more configuration to reintegrate it with my DE (KDE Plasma 6). Is there a simpler way to declaratively block internet access of an application?