OpenSnitch is a solid option, but I don’t find it that reliable to install on Arch. Instead I’d suggest looking at Safing’s Portmaster.

Haven't tried it on Deck, but iptables can do a per-uid based rule which I've used in the past

I.E. login+run restricted games under a particular login, OR sudo to that user for running but allow X-forwarding+PulseAudio to my current login

I don't know if it works as I think it does, but you can try relaunching steam in offline mode