Both OpenSnitch and SimpleWall block by default. You can also set a timeout so that if you don’t respond in a certain amount of time they automatically create a permanent block rule. You can also check your rules and activity at any point. If a specific application is misbehaving you can always check its rules and change them, or delete them and start over. They’re very efficient, and get less intrusive over time as you respond to prompts and create more rules.