I use opensnitch and eventually found the appropriate blocking rule for every time a snap is launched or appimage from some random mount path for the process.
Not sure what's wrong with using the established package management system instead of reinventing the wheel to distribute an app on your own binary system that you control - why?!?!
The goal is to be distro-agnostic, but I find that Flatpak and Snap both add more bloat than is worth it. Either just use distro packages, or, if you really want cross-platform, get an AppImage and be done with it.
