Meh, I was excited that “network level” would mean something closer to little snitch rather than yet another dns blocklist.

For Windows you can try Portmaster: https://safing.io/portmaster/

or Glasswire: https://www.glasswire.com/?os=win