How to allow only specific domains for an app when all apps are firewalled and few have been "excluded from universal firewall/DNS"?

To set app-specific "Domain" and "IP" "trust" (allow) / "block" (deny) rules from Configure -> Apps -> (select that specific app to views its dashboard and set rules).

If you also "Isolate" the app, only IPs / domains you explicitly "trust" will be allowed for that app.