If it isnt sandboxed at the network level you definitely should Create a separate user that is firewalled and run mullvad with killswitch on