Meanwhile I found rethink dns. It's a DNS based blocking that also use the local VPN similar to tracker control, however you can add any wireguard VPN to use inside rethink dns. This allows one to use any VPN provider that supports wireguard.
The UI is not as good as tracker control for what you want, but it's possible to show logs of blocked request for each app.