Option to completely disable network access in a secondary profile

[de0u]

Might it be possible to add a toggle for secondary profiles that would completely disable network access for all apps in that profile? One suggested use case would be a profile with third-party camera / image-editing apps, so that pictures could be taken and edited within the profile and then exported via USB storage.

It appears that a current workaround is to create a secondary profile, install a VPN app in it, enable the VPN "kill switch", but then to ensure that the VPN app doesn't have access to a working provider account (or, perhaps, to delete the VPN app). But that approach is complicated, whereas a "disable network access" toggle in the profile management UI would be simpler for users (and hopefully the implementation would also be fairly straightforward).

This feature was requested by a discussion forum user: https://discuss.grapheneos.org/d/16433-a-completely-offline-user-profile