install via flatpak (which uses bubblewrap iirc for sandboxing) and use flatseal to remove the network permission. You can also manually edit this through .local/share/flatpak/overrides.