A good solution to this is using iptables to control what has access to which networks, rather than relying on the OS. AFWall+ is a nice front end for iptables and requires root. Netguard is another option that doesn't require root, but I'm not sure how that one works.