It depends. With GOS you can totally block an app. But maybe there are some apps you don´t want to block, then you can adjust some fine tuning with netguard (e.g. allow connect to vendor API of an app, but not to firebase, crashlytics and so on). Further more with netguaurd you can do some adblocking with blacklists (non google play version only!).
Be aware: after booting the device it takes a few seconds till netguard has started. Theoretically any app which has started before could "bypass" netguard within this little gap.