--pid-owner was removed from Linux some time in the 2.4 days IIRC.

That's a really outdated version of the man page. The current one is: https://ipset.netfilter.org/iptables-extensions.man.html

Probably the closest thing these days is to use the cgroup match extension, together with something that makes sure separate apps are moved to their own cgroup. But that cgroup would be under a separate parent cgroup for each user so it's not ideal.

I expect NFQUEUE or some EBPF magic is a better way to do things - you don't want to be constantly adding/removing per-process iptables rules.

Iptables is a little old. You may want the newer nftables instead.

The iptables rules can be converted directly to nft with iptables-translate and the syntax is more simple.

The owner module can control outbound communication by uid/gid. [1] There are no modules to handle things by PID AFAIK. This can however be accomplished by SELinux and Apparmor custom rules but that is a loaded topic.

Firejail [2] and Bubblewrap [3] can put limits on application capabilities and/or take away network access.

A round-about and heavy handed way to manage communications by PID would be to isolation applications in their own VM or container and map the VM or container to a unique user or group.

[1] - https://ipset.netfilter.org/iptables-extensions.man.html

[2] - https://github.com/netblue30/firejail

[3] - https://github.com/containers/bubblewrap