I do active blocking. I permanently allow any application that I can trust. For example I will allow chrome to connect permanently. But if it is some cryptically named service trying to connect I will block it permanently. After an initial approval stage you do not see too may popups for approval.

But I can see how this can be a disruptive process, when all you want is some work done. I wish we lived in a place where I did not have to use tools like this.