It might sound a bit complicated but another option could be to set up an always-on VPN with killswitch for each profile. This way if one simply disconnects the profile's VPN to stop mobile data / Wi-Fi usage, the general call and SMS functions will be preserved.
So it seems there are a few solutions to the secondary user mobile data control, but no direct one as in the owner profile.