yes, but actually no.

there are apps (like rethink DNS) that pack multiple functions in the app. if an app is being used to handle a VPN connection, it gets to process all your network traffic, see for each packet which app does it belong to, and can do both firewalling, split tunneling by app or type of traffic, and can also filter packets. most VPN apps just don’t bother with it because its a complex task, and most users wouldn’t use it anyway.

There’s also AFWall+ that can configure the kernel’s firewall with root permissions, without setting itself up to handle a V0N connection.

both of these apps are available on f-droid