Think out of the box: Just don't let the app connect to an IP it has not resolved a domain name for.

That's what we can do with the Portmaster (https://github.com/safing/portmaster). Check it out!