This is what I use. I mostly just have the DNS filter turned on to allow for blocking similar to what my pihole does at home, bit allows me to have it when I’m outside of the house, too. But it has lots of other capabilities like a firewall, proxying through Wiegaurd or Tor, anti-censorship features, etc. It does use your device’s VPN connection but it creates a local VPN just to force routing all apps through it and then if you want an additional external VPN you use the proxying, but that’s optional.

But the DNS-only option doesn’t drain the battery like a full filter/firewall may, so that’s one reason I only use it for that. And I use GrapheneOS, so apps are easier to control at the OS level than standard Android, do it’s not as necessary for me anyway.