The easy method uses Qubes OS firewall but does not play nicely with domains with multiple IPs associated to it, or if they change often. Add a disposable qube providing network with sys-whonix as a netvm, and use this one as the netvm for the qube you want to filter outgoing connection. This “sys-firewall” buffer will be able to hold firewall rules as sys-whonix can’t do that. Just add the firewall rule you want in your qube settings.
The other method only supports HTTP but works flawlessly with domains behind load balancers or multiple IPs. This would be to use an URL filtering HTTPS proxy and put it behind sys-whonix, the qube that will use a single domain don’t even need to have a netvm.
Both of these methods will provide firewall capability but at the cost
of risk to stream isolation. At the Whonix gateway all traffic will seem
to have come from a single IP address.
I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.
As mentioned above, Tor Browser uses a Tor SocksPort by default as per upstream default.
nftables (and its predecessor iptables) however does not inherently understand application-layer protocols like SOCKS. This is why nftables firewalls are unable to filter Tor Browser’s traffic. See SOCKS Firewalling for a detailed technical explanation.
Firewall (IP, DNS) based filtering and would require either:
A) Transparent Proxying: Using system default networking, i.e. not using a Tor SocksPort and thereby breaking Stream Isolation.
B) DPI: Deep package inspection in case using a firewall. This is undocumented.