Piracy

OpenSnitch maybe? I don't know how well it works with game launchers.

You can completely cut off internet access with network namespaces but I don't know a GUI tool for setting those up.

Haven't tried it on Deck, but iptables can do a per-uid based rule which I've used in the past

I.E. login+run restricted games under a particular login, OR sudo to that user for running but allow X-forwarding+PulseAudio to my current login

I don't know if it works as I think it does, but you can try relaunching steam in offline mode

OpenSnitch is a solid option, but I don’t find it that reliable to install on Arch. Instead I’d suggest looking at Safing’s Portmaster.

You could also try installing ufw There's a guide here. There are also a bunch of GUI's made for ufw so you don't have to use the terminal to actually use the firewall. Apparently you will have to reinstall it everytime there is an update (for steam os presumably).

I haven't personally tried this stuff, but I think it might be easiest to make a bash script to run the commands to setup ufw so that you don't have to do it multiple times.

There is a built in firewall in steamos called iptables but its more for blocking access to ports system wide, and its also very painful to use.