It is quite annoying. Samsung has trimmed up their bloat and strange customizations over the years, but some things are still incorrect as far as I see them.

NetGuard can manage network access on a per app basis but it uses the VPN function to do so, while not actually being a VPN service. Sadly this means I can’t be using an on-device VPN at the same time as turning off app data.

Annoying compromise.