You can analyze the internet connections of apps with PCAPdroid (I guess NetGuard works as well for that purpose).
And you can block unwanted traffic with a firewall (NetGuard) or based on DNS with apps like Blokada or RethinkDNS or the like.
The “blocking apps” (especially NG) provide the function you ask for (deny internet access per app).
They may be used as well for analysis of traffic but may be somewhat limited for that purpose.
Note that all these apps utilize the VPN-interface of the system which means you can only use one of those apps at a time and you cannot use them in parallel with Adavanced Privacy’s Hide my IP-feature.
edits: hyperlinks, clarifications etc.