There is a solution to hide Telegram hypervisor VM using AppArmor. Maybe we could use bwrap --unbind, some day I will do tests.
Other solutions: