You can do this. But you need to use rethinkdns and download the configuration of the proton vpn wireguard server(s) you wanna reach. You can have internet blocked for individual apps, have some tunnel without VPN but DNS and firewall protection and some go through servers of proton (even per app to different servers). It’s a powerful tool. You won’t get the same protection as you would get with let’s say GrapheneOS but you are getting damn close to it if done right

If you're interested in that level of control, it's time to look hard at GrapheneOS. "Internet" is a permission you can grant or deny for each app, under GrapheneOS.

~~But I'm not aware of a way to selectively direct phone traffic through Proton VPN, at the phone. Even on GrapheneOS.~~

~~Enough skill with an expensive router could do it, but only on your home network, or only while routing all of your phone traffic back to your home network via yet another VPN.~~

Edit: TIL, Proton VPN supports split tunneling. Sweet! Look under Settings - Advanced - Split Tunneling - then pick your apps to include/exclude.

Edit 2: TIL DivestOS also supports "Internet" as a per app Permission. Very cool.

The apps you want to block entirely, you can go into Android settings for each of them individually, and turn off all their Mobile Data & WiFi access options.

Apps that you want to allow outside Proton VPN, you can add to the Split Tunneling list in Proton VPN. But you have to turn off the Block Without VPN option.

It sounds like that'll get you what you want.

Just a note: The app 'Rethink DNS and Firewall' can do this with any Wireguard VPN.

You need root for that. This is trivial with root.

If you don't want to patch with Magisk, look at KernelSU

it seems like you merely need to disable the "Block connections without VPN".

Then in your android settings there should be a toggle to deny network access to certain apps in the android permission settings. so the apps that are split tunneled you can just deny or allow network

It can't be used with ProtonVPN (I assume) but I use NoRoot Firewall for exactly this purpose. It works by setting up a VPN and letting you enable / disable network access for each app, including system apps. It can also block on just WiFi or just cell data or both or neither. It blocks all apps by default until you configure their access. You can also setup more advanced rules for all apps or just some apps. For instance, you can set it where an app can contact AppCompany.com but not Google.com