You can do this. But you need to use rethinkdns and download the configuration of the proton vpn wireguard server(s) you wanna reach. You can have internet blocked for individual apps, have some tunnel without VPN but DNS and firewall protection and some go through servers of proton (even per app to different servers). It’s a powerful tool. You won’t get the same protection as you would get with let’s say GrapheneOS but you are getting damn close to it if done right
You don’t need shelter. Create a multiple user account one just for that app… on GrapheneOS. It is totally isolated from the rest. You can use a vpn just in that user profile too